Common Weakness Enumeration
CWE-665
DiscouragedImproper Initialization
Abstraction: Class · Status: Draft
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
441 vulnerabilities reference this CWE, most recent first.
CVE-2026-107175 (GCVE-0-2026-107175)
Vulnerability from cvelistv5 – Published: 2026-10-07 12:38 – Updated: 2026-10-07 14:40
VLAI
EPSS
VEX
Title
MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
Summary
MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified.
When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.
Security impact:
- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.
- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.
Preconditions:
- An authenticated user with write access to at least one MISP event.
- The user modifies the event's distribution or sharing_group_id field.
Affected versions: <2.5.48
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-07 12:35 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:39 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/19a389d19 | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-07 12:35 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/19a389d19.patch
a23e99457b84… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
19a389d19f65
|
fix: [correlation] fix correlation distribution refresh on | a23e99457b84… |
Fix summary
The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.
Patch summary
In app/Model/Event.php, the beforeSave method was modified. Previously, $this->__beforeSaveData was set to the full incoming $this->data['Event'] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event's sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.
Weakness rationale
- CWE-284 The core security impact is that correlation data access boundaries are not enforced when an event's sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure.
- CWE-665 The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection.
Attack pattern rationale
- CAPEC-114 The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for 'stale derived data after parameter change' exists in the CAPEC catalog.
Assumptions to verify
- The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.
- The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.
- CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers 'stale derived data after a legitimate parameter change' and the mapping is approximate.
- The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.
- CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.
- The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 11 | medium | 6 |
- 2026-09-23 07:41 UTC Fix developed Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on https://github.com/MISP/MISP/commit/19a389d19.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107175",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:39:59.827397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:40:14.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"Event model (app/Model/Event.php)",
"Correlation engine"
],
"product": "MISP",
"programFiles": [
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\u003c/p\u003e\u003cp\u003eWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\u003c/p\u003e\u003cp\u003eSecurity impact:\u003c/p\u003e\u003cp\u003e- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\u003c/p\u003e\u003cp\u003e- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated user with write access to at least one MISP event.\u003c/p\u003e\u003cp\u003e- The user modifies the event\u0027s distribution or sharing_group_id field.\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event\u0027s distribution level or sharing group is modified.\n\nWhen a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted.\n\nSecurity impact:\n\n- Stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure.\n\n- Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing.\n\nPreconditions:\n\n- An authenticated user with write access to at least one MISP event.\n\n- The user modifies the event\u0027s distribution or sharing_group_id field.\n\nAffected versions: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T12:35:42Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T12:38:44.252Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/19a389d19"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.\u003c/p\u003e"
}
],
"value": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly."
}
],
"title": "MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The exact fixed version number is not specified in the patch metadata; the tag boundary indicates the fix is 47 commits after v2.5.48, but the release tag containing this commit is unknown.",
"The security impact is assessed as limited information disclosure through stale correlations; the patch does not indicate a direct privilege escalation or data corruption vector.",
"CAPEC-114 (Parameter Tampering) is the closest available mapping; no CAPEC specifically covers \u0027stale derived data after a legitimate parameter change\u0027 and the mapping is approximate.",
"The assumption that the afterSave hook uses __beforeSaveData to compare old vs new distribution/sharing_group_id values is inferred from the commit message and the code change pattern; the afterSave code itself is not included in the patch.",
"CVSS UI:N assumes the stale correlation data is accessible via the normal MISP UI/API without additional user interaction beyond the initial event edit.",
"The Co-Authored-By line for Claude Opus 4.8 is treated as a tool credit, not a human remediation developer."
],
"capecRationale": [
{
"capecId": "CAPEC-114",
"rationale": "The closest plausible CAPEC is Parameter Tampering: a user modifies the distribution or sharing_group_id parameters of an event, and the application fails to properly enforce the resulting access-control changes on correlated data. The mapping is uncertain because this is not a malicious tamper per se but a legitimate parameter modification that exposes a system defect; however, CAPEC-114 best captures the scenario where parameter changes are not properly reflected in downstream access enforcement. No more specific CAPEC for \u0027stale derived data after parameter change\u0027 exists in the CAPEC catalog."
}
],
"commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user simply edits an event\u0027s sharing group; no race condition or complex setup is needed. AT:N: No manipulation of a separate attack target is required. PR:L: Requires an authenticated user with write access to events. UI:N: The stale correlation persists without further user interaction. VC/VI/VA:N: The vulnerable component (the event save logic) is not directly compromised in confidentiality, integrity, or availability. SC:L: The security impact is on the broader MISP instance: users in a broader sharing group may see correlation data referencing an event that was moved to a more restrictive group, resulting in limited information disclosure. SI/SA:N: No integrity or safety impact on other systems.",
"fixSummary": "The fix ensures that the before-save hook retrieves the previously persisted distribution and sharing_group_id values from the database for existing events, rather than capturing the incoming (new) data. This allows the after-save logic to correctly detect when these fields have changed and trigger a correlation refresh, ensuring access boundaries on correlated data are enforced promptly.",
"generatedAt": "2026-10-07T12:35:42.209027Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 6,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
"patchSummary": "In app/Model/Event.php, the beforeSave method was modified. Previously, $this-\u003e__beforeSaveData was set to the full incoming $this-\u003edata[\u0027Event\u0027] array. The patch replaces this with: (1) initializing __beforeSaveData to null, (2) checking whether the event has an existing id (i.e., it is an update, not a create), (3) issuing a targeted database query (recursive -1, selecting only Event.distribution and Event.sharing_group_id) to fetch the currently stored values, and (4) storing those fetched values in __beforeSaveData. This ensures the after-save comparison correctly identifies distribution/sharing_group_id changes.",
"patchTruncated": false,
"patches": [
{
"commit": "19a389d19f65e25ba3328e72e6ad23919a39ccd0",
"date": "Wed, 23 Sep 2026 09:41:31 +0200",
"patchSha256": "a23e99457b847b37183a6159eec9860f3cc8243bae000bc81cbd3449fa7aa225",
"source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"subject": "fix: [correlation] fix correlation distribution refresh on"
}
],
"source": "https://github.com/MISP/MISP/commit/19a389d19.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-07T12:35:42Z",
"version": "2.0.3"
},
"subject": "fix: [correlation] fix correlation distribution refresh on",
"tagVersionBoundary": {
"commits_after_fix": 47,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-284",
"rationale": "The core security impact is that correlation data access boundaries are not enforced when an event\u0027s sharing group or distribution changes. Stale correlations can expose event data to users who should no longer have access, constituting an improper access control failure."
},
{
"cweId": "CWE-665",
"rationale": "The root cause is that the __beforeSaveData variable was initialized with the incoming (new) data rather than the previously stored data, causing the change-detection logic in afterSave to fail. This is a classic improper initialization of a state variable used for change detection."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (19a389d19f65e25ba3328e72e6ad23919a39ccd0): fix: [correlation] fix correlation distribution refresh on",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/19a389d19.patch"
],
"timestamp": "2026-09-23T07:41:31Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20264"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-107175",
"datePublished": "2026-10-07T12:38:44.252Z",
"dateReserved": "2026-10-07T12:38:41.839Z",
"dateUpdated": "2026-10-07T14:40:14.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101957 (GCVE-0-2026-101957)
Vulnerability from cvelistv5 – Published: 2026-10-14 16:20 – Updated: 2026-10-14 20:46
VLAI
EPSS
VEX
Title
Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used
Summary
An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 20:37 UTC
CWE
- CWE-665 - Improper Initialization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.juniper.net/JSA112187 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Juniper Networks | Junos OS |
Affected:
0 , < 23.2R2-S7.7
(custom)
Affected: 23.4 , < 23.4R2-S8.13 (custom) Affected: 24.2 , < 24.2R2-S5.5 (custom) Affected: 24.4 , < 24.4R2-S5 (custom) Affected: 25.2 , < 25.2R2-S2 (custom) Affected: 25.4 , < 25.4R1-S3 (custom) Affected: 26.2 , < 26.2R1-S2 (custom) |
|
| Juniper Networks | Junos OS Evolved |
Affected:
0 , < 23.2R2-S7.7-EVO
(custom)
Affected: 23.4 , < 23.4R2-S8.11-EVO (custom) Affected: 24.2 , < 24.2R2-S5.6-EVO (custom) Affected: 24.4 , < 24.4R2-S5-EVO (custom) Affected: 25.2 , < 25.2R2-S2-EVO (custom) Affected: 25.4 , < 25.4R1-S3-EVO (custom) Affected: 26.2 , < 26.2R1-S2-EVO (custom) Affected: 23.4X100 (custom) Affected: 25.2X100 , < 25.2X100-D35-EVO (custom) Affected: 25.4X300 , < 25.4X300-D40-EVO (custom) |
Date Public
2026-10-14 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101957",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T20:37:24.368063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T20:46:20.782Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Junos OS",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "23.2R2-S7.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "23.4R2-S8.13",
"status": "affected",
"version": "23.4",
"versionType": "custom"
},
{
"lessThan": "24.2R2-S5.5",
"status": "affected",
"version": "24.2",
"versionType": "custom"
},
{
"lessThan": "24.4R2-S5",
"status": "affected",
"version": "24.4",
"versionType": "custom"
},
{
"lessThan": "25.2R2-S2",
"status": "affected",
"version": "25.2",
"versionType": "custom"
},
{
"lessThan": "25.4R1-S3",
"status": "affected",
"version": "25.4",
"versionType": "custom"
},
{
"lessThan": "26.2R1-S2",
"status": "affected",
"version": "26.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Junos OS Evolved",
"vendor": "Juniper Networks",
"versions": [
{
"lessThan": "23.2R2-S7.7-EVO",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "23.4R2-S8.11-EVO",
"status": "affected",
"version": "23.4",
"versionType": "custom"
},
{
"lessThan": "24.2R2-S5.6-EVO",
"status": "affected",
"version": "24.2",
"versionType": "custom"
},
{
"lessThan": "24.4R2-S5-EVO",
"status": "affected",
"version": "24.4",
"versionType": "custom"
},
{
"lessThan": "25.2R2-S2-EVO",
"status": "affected",
"version": "25.2",
"versionType": "custom"
},
{
"lessThan": "25.4R1-S3-EVO",
"status": "affected",
"version": "25.4",
"versionType": "custom"
},
{
"lessThan": "26.2R1-S2-EVO",
"status": "affected",
"version": "26.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "23.4X100",
"versionType": "custom"
},
{
"lessThan": "25.2X100-D35-EVO",
"status": "affected",
"version": "25.2X100",
"versionType": "custom"
},
{
"lessThan": "25.4X300-D40-EVO",
"status": "affected",
"version": "25.4X300",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[ protocols bgp group \u0026lt;name\u0026gt; graceful-restart long-lived advertise-to-non-llgr-neighbor ] is configured and more than 32 of the peers in this group are established.\u003cbr\u003e\u003cbr\u003eAnd [ system processes routing bgp \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eupdate-threading \u003c/span\u003e\n\n] is not configured!\u003cbr\u003e"
}
],
"value": "[ protocols bgp group \u003cname\u003e graceful-restart long-lived advertise-to-non-llgr-neighbor ] is configured and more than 32 of the peers in this group are established.\n\nAnd [ system processes routing bgp \n\nupdate-threading \n\n] is not configured!"
}
],
"datePublic": "2026-10-14T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group.\u003cbr\u003e\u003cp\u003e\u003c/p\u003e\u003cbr\u003e\n\n\n\n\u003cp\u003e\u003c/p\u003e"
}
],
"value": "An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause an rpd crash via an LLGR-stale route update readvertised to a configured non-LLGR peer group."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:20:25.147Z",
"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"shortName": "juniper"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.juniper.net/JSA112187"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": true,
"type": "text/html",
"value": "The following software releases have been updated to resolve this specific issue:\u003cbr\u003e\n\u003cbr\u003e\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\u003cbr\u003e\u003cbr\u003eJunos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.\u003cbr\u003e\u003cbr\u003e\n\n\u003cb\u003eNote:\u003c/b\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "The following software releases have been updated to resolve this specific issue:\n\n\n\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\n\nJunos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.\n\n\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, and Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."
}
],
"source": {
"advisory": "JSA112187",
"defect": [
"1953394"
],
"discovery": "INTERNAL"
},
"title": "Junos OS and Junos OS Evolved: A remote BGP peer causes an rpd crash when long-lived graceful restart (LLGR) is used",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Configure \u0027graceful-restart long-lived advertise-to-non-llgr-neighbor omit-no-export\u0027 or remove \u0027advertise-to-non-llgr-neighbor\u0027.\u003cbr\u003e"
}
],
"value": "Configure \u0027graceful-restart long-lived advertise-to-non-llgr-neighbor omit-no-export\u0027 or remove \u0027advertise-to-non-llgr-neighbor\u0027."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
"assignerShortName": "juniper",
"cveId": "CVE-2026-101957",
"datePublished": "2026-10-14T16:20:25.147Z",
"dateReserved": "2026-09-28T16:28:35.624Z",
"dateUpdated": "2026-10-14T20:46:20.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94370 (GCVE-0-2026-94370)
Vulnerability from cvelistv5 – Published: 2026-10-14 05:43 – Updated: 2026-10-14 16:02
VLAI
EPSS
VEX
Title
Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
Summary
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:02 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wiki.qt.io/List_of_known_vulnerabilities_… | issue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| qt | Qt_for_MCUs |
Affected:
2.12.1 , < 2.12.3
(python)
cpe:2.3:a:qt:qt_for_mcus:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:02:10.297104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:02:30.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"qul"
],
"product": "Qt_for_MCUs",
"vendor": "qt",
"versions": [
{
"lessThan": "2.12.3",
"status": "affected",
"version": "2.12.1",
"versionType": "python"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qt:qt_for_mcus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.12.3",
"versionStartIncluding": "2.12.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public \u003ccode\u003eQul::String\u003c/code\u003e interface type, and that text is held in a \u003ccode\u003estd::string\u003c/code\u003e, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.\u003c/p\u003e"
}
],
"value": "A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:H/E:U/S:P/AU:N/R:U/V:D/RE:M",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-590",
"description": "CWE-590 Free of Memory not on the Heap",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T05:43:27.953Z",
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"shortName": "Qt"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-94370:"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"assignerShortName": "Qt",
"cveId": "CVE-2026-94370",
"datePublished": "2026-10-14T05:43:27.953Z",
"dateReserved": "2026-09-21T11:36:04.324Z",
"dateUpdated": "2026-10-14T16:02:30.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93495 (GCVE-0-2026-93495)
Vulnerability from cvelistv5 – Published: 2026-10-01 02:00 – Updated: 2026-10-05 01:49
VLAI
EPSS
VEX
Summary
Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device.
Refer to the '
Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 15:56 UTC
CWE
- CWE-665 - Improper Initialization
Assigner
References
1 reference
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | Motherboard(PRIME Z390-A ) |
Affected:
through 2101
(custom)
cpe:2.3:a:asus:motherboard_prime_z390-a_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(PRIME Z390-A/H10 ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_prime_z390-a_h10_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG MAXIMUS XI HERO ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_maximus_xi_hero_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG MAXIMUS XI HERO (WI-FI) ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_maximus_xi_hero_wi-fi_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG MAXIMUS XI FORMULA ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_maximus_xi_formula_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG MAXIMUS XI CODE ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_maximus_xi_code_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG MAXIMUS XI EXTREME ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_maximus_xi_extreme_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG MAXIMUS XI APEX ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_maximus_xi_apex_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG MAXIMUS XI GENE ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_maximus_xi_gene_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG STRIX Z390-E GAMING ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_strix_z390-e_gaming_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(ROG STRIX Z390-F GAMING ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_rog_strix_z390-f_gaming_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(Pro WS C246-ACE ) |
Affected:
through 2101
cpe:2.3:a:asus:motherboard_pro_ws_c246-ace_:through_2101:*:*:*:*:*:*:* |
|
| ASUS | Motherboard(WS Z390 PRO ) |
Affected:
through 1401
cpe:2.3:a:asus:motherboard_ws_z390_pro_:through_1401:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T15:56:01.357635Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:56:20.775Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Motherboard(PRIME Z390-A )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(PRIME Z390-A/H10 )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG MAXIMUS XI HERO )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG MAXIMUS XI HERO (WI-FI) )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG MAXIMUS XI FORMULA )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG MAXIMUS XI CODE )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG MAXIMUS XI EXTREME )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG MAXIMUS XI APEX )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG MAXIMUS XI GENE )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG STRIX Z390-E GAMING )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(ROG STRIX Z390-F GAMING )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(Pro WS C246-ACE )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 2101"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Motherboard(WS Z390 PRO )",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "through 1401"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_prime_z390-a_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_prime_z390-a_h10_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_maximus_xi_hero_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_maximus_xi_hero_wi-fi_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_maximus_xi_formula_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_maximus_xi_code_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_maximus_xi_extreme_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_maximus_xi_apex_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_maximus_xi_gene_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_strix_z390-e_gaming_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_rog_strix_z390-f_gaming_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_pro_ws_c246-ace_:through_2101:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:motherboard_ws_z390_pro_:through_1401:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device.\u003cbr\u003eRefer to the \u0027\u0026nbsp;\nSecurity Update for Multiple ASUS Motherboards\u0026nbsp;\u0026nbsp;\u0027 section on the ASUS Security Advisory for more information.\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device.\nRefer to the \u0027\u00a0\nSecurity Update for Multiple ASUS Motherboards\u00a0\u00a0\u0027 section on the ASUS Security Advisory for more information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665\uff1aImproper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T01:49:10.102Z",
"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
"shortName": "ASUS"
},
"references": [
{
"url": "https://www.asus.com/security-advisory"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
"assignerShortName": "ASUS",
"cveId": "CVE-2026-93495",
"datePublished": "2026-10-01T02:00:12.144Z",
"dateReserved": "2026-09-18T07:27:07.993Z",
"dateUpdated": "2026-10-05T01:49:10.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57229 (GCVE-0-2026-57229)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:18 – Updated: 2026-09-25 19:21
VLAI
EPSS
VEX
Title
Suricata smtp/mime: incomplete state reset allows detection bypass
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 19:21 UTC
CWE
- CWE-665 - Improper Initialization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/4985eb9da… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/c0215c7e1… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8649 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T19:21:29.096537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T19:21:41.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part\u0027s encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665: Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:18:38.625Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-ph5p-pm8r-m355",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-ph5p-pm8r-m355"
},
{
"name": "https://github.com/OISF/suricata/commit/4985eb9daea2f765b6ef59a58fa02e5c71c0a77c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/4985eb9daea2f765b6ef59a58fa02e5c71c0a77c"
},
{
"name": "https://github.com/OISF/suricata/commit/c0215c7e175b0000ef8450928dd1f3453c48379b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/c0215c7e175b0000ef8450928dd1f3453c48379b"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8649",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8649"
}
],
"source": {
"advisory": "GHSA-ph5p-pm8r-m355",
"discovery": "UNKNOWN"
},
"title": "Suricata smtp/mime: incomplete state reset allows detection bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57229",
"datePublished": "2026-09-18T20:18:38.625Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-25T19:21:41.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54777 (GCVE-0-2026-54777)
Vulnerability from cvelistv5 – Published: 2026-07-08 22:01 – Updated: 2026-07-10 03:55
VLAI
EPSS
VEX
Title
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
Summary
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 00:00 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/CoreWCF/CoreWCF/security/advis… | x_refsource_CONFIRM |
| https://github.com/CoreWCF/CoreWCF/commit/8ed9c78… | x_refsource_MISC |
| https://github.com/CoreWCF/CoreWCF/commit/e7d2253… | x_refsource_MISC |
| https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1 | x_refsource_MISC |
| https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T03:55:40.674Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CoreWCF",
"vendor": "CoreWCF",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.9.0, \u003c 1.9.1"
},
{
"status": "affected",
"version": "\u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665: Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T22:01:21.323Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-6jj2-4q5c-x8g6"
},
{
"name": "https://github.com/CoreWCF/CoreWCF/commit/8ed9c780c7c6fb22fa215c5771dee0c1e49596b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/CoreWCF/CoreWCF/commit/8ed9c780c7c6fb22fa215c5771dee0c1e49596b7"
},
{
"name": "https://github.com/CoreWCF/CoreWCF/commit/e7d225394fd429900dcbc445dcdd53b94e964077",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/CoreWCF/CoreWCF/commit/e7d225394fd429900dcbc445dcdd53b94e964077"
},
{
"name": "https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1"
},
{
"name": "https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1"
}
],
"source": {
"advisory": "GHSA-6jj2-4q5c-x8g6",
"discovery": "UNKNOWN"
},
"title": "CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54777",
"datePublished": "2026-07-08T22:01:21.323Z",
"dateReserved": "2026-06-15T23:23:57.714Z",
"dateUpdated": "2026-07-10T03:55:40.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54409 (GCVE-0-2026-54409)
Vulnerability from cvelistv5 – Published: 2026-07-02 14:49 – Updated: 2026-07-02 16:10
VLAI
EPSS
VEX
Summary
A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-02 16:09 UTC
CWE
- CWE-665 - Improper Initialization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Protect Application |
Affected:
0 , < 7.1.83
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-02T16:09:56.430776Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T16:10:07.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Protect Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "7.1.83",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T14:49:16.639Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-54409",
"datePublished": "2026-07-02T14:49:16.639Z",
"dateReserved": "2026-06-13T15:00:00.605Z",
"dateUpdated": "2026-07-02T16:10:07.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54279 (GCVE-0-2026-54279)
Vulnerability from cvelistv5 – Published: 2026-06-22 16:32 – Updated: 2026-06-22 17:40
VLAI
EPSS
VEX
Title
AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
Summary
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-22 17:40 UTC
CWE
- CWE-665 - Improper Initialization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/aio-libs/aiohttp/security/advi… | x_refsource_CONFIRM |
| https://github.com/aio-libs/aiohttp/commit/a329a7… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54279",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T17:40:17.638561Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T17:40:23.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "aiohttp",
"vendor": "aio-libs",
"versions": [
{
"status": "affected",
"version": "\u003c 3.14.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 1.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665: Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T16:32:45.407Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"
},
{
"name": "https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2"
}
],
"source": {
"advisory": "GHSA-2fqr-mr3j-6wp8",
"discovery": "UNKNOWN"
},
"title": "AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54279",
"datePublished": "2026-06-22T16:32:45.407Z",
"dateReserved": "2026-06-12T17:13:32.280Z",
"dateUpdated": "2026-06-22T17:40:23.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44434 (GCVE-0-2026-44434)
Vulnerability from cvelistv5 – Published: 2026-07-16 22:34 – Updated: 2026-07-18 03:21
VLAI
EPSS
VEX
Title
Quicly is vulnerable to stateless reset injection
Summary
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection through lack of packet entry validation. The QUIC protocol is designed to withstand packet injection attacks, once the handshake is complete. Only packets that carry some secret patterns are considered as stateless resets. Quicly allows the peer to share up to 4 such patterns per connection. However, until now, it failed to determine which of the 4 slots that it uses to retain the secret patterns contains a valid entry. As the slots are zero-initialized, the failure meant that, unless the peer advertised 4 of such patterns, an all-zero pattern was treated as a stateless reset.In effect, this allowed an on-path attacker to reset QUIC connections governed by Quicly. This issue has been fixed by commit dccf5d4.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-18 03:21 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/h2o/quicly/security/advisories… | x_refsource_CONFIRM |
| https://github.com/h2o/quicly/commit/dccf5d4579c7… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-18T03:21:11.398981Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T03:21:24.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quicly",
"vendor": "h2o",
"versions": [
{
"status": "affected",
"version": "\u003c dccf5d4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection through lack of packet entry validation. The QUIC protocol is designed to withstand packet injection attacks, once the handshake is complete. Only packets that carry some secret patterns are considered as stateless resets. Quicly allows the peer to share up to 4 such patterns per connection. However, until now, it failed to determine which of the 4 slots that it uses to retain the secret patterns contains a valid entry. As the slots are zero-initialized, the failure meant that, unless the peer advertised 4 of such patterns, an all-zero pattern was treated as a stateless reset.In effect, this allowed an on-path attacker to reset QUIC connections governed by Quicly. This issue has been fixed by commit dccf5d4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665: Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T22:34:09.386Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/h2o/quicly/security/advisories/GHSA-899f-49jq-pfh8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/h2o/quicly/security/advisories/GHSA-899f-49jq-pfh8"
},
{
"name": "https://github.com/h2o/quicly/commit/dccf5d4579c7ae9dd6e8f90c36d52e311bb60710",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/h2o/quicly/commit/dccf5d4579c7ae9dd6e8f90c36d52e311bb60710"
}
],
"source": {
"advisory": "GHSA-899f-49jq-pfh8",
"discovery": "UNKNOWN"
},
"title": "Quicly is vulnerable to stateless reset injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44434",
"datePublished": "2026-07-16T22:34:09.386Z",
"dateReserved": "2026-05-06T14:40:00.954Z",
"dateUpdated": "2026-07-18T03:21:24.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34553 (GCVE-0-2026-34553)
Vulnerability from cvelistv5 – Published: 2026-03-31 22:17 – Updated: 2026-04-03 16:42
VLAI
EPSS
VEX
Title
iccDEV: DoS in CIccCLUT::Iterate() & CIccMBB::Describe()
Summary
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). This issue has been patched in version 2.3.1.6.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-03 16:42 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/InternationalColorConsortium/i… | x_refsource_CONFIRM |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
| https://github.com/InternationalColorConsortium/i… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| InternationalColorConsortium | iccDEV |
Affected:
< 2.3.1.6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34553",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-03T16:42:28.325586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T16:42:40.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iccDEV",
"vendor": "InternationalColorConsortium",
"versions": [
{
"status": "affected",
"version": "\u003c 2.3.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate() and output produced by CIccMBB::Describe() (via CLUT dumping). This issue has been patched in version 2.3.1.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-562",
"description": "CWE-562: Return of Stack Variable Address",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665: Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-31T22:17:30.597Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-5r4q-77w5-3q3h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-5r4q-77w5-3q3h"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/issues/704",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/issues/704"
},
{
"name": "https://github.com/InternationalColorConsortium/iccDEV/pull/737",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/InternationalColorConsortium/iccDEV/pull/737"
}
],
"source": {
"advisory": "GHSA-5r4q-77w5-3q3h",
"discovery": "UNKNOWN"
},
"title": "iccDEV: DoS in CIccCLUT::Iterate() \u0026 CIccMBB::Describe()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34553",
"datePublished": "2026-03-31T22:17:30.597Z",
"dateReserved": "2026-03-30T16:31:39.264Z",
"dateUpdated": "2026-04-03T16:42:40.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-3
Requirements
Strategy: Language Selection
- Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
Mitigation
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Implementation
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
Mitigation
Implementation
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
Mitigation
Implementation
Avoid race conditions (CWE-362) during initialization routines.
Mitigation
Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or data.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.