Common Weakness Enumeration
CWE-749
AllowedExposed Dangerous Method or Function
Abstraction: Base · Status: Incomplete
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
363 vulnerabilities reference this CWE, most recent first.
GCVE-1-2026-20117 (CVE-2026-106513)
Vulnerability from gna-1 – Published: 2026-10-06 18:58 – Updated: 2026-10-06 19:03
VLAI
EPSS
VEX
Title
MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
Summary
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker's Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
Supplier · CNA (v2.0.3)
Decision recorded 2026-10-06 18:56 UTC
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/2ebf29f93 | patch |
Impacted products
GCVE extensions
AI-generated
Partially reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-06 18:56 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/2ebf29f93.patch
8262490f9bcc… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
2ebf29f93dd8
|
fix: [security] Make redis host and attachment download | 8262490f9bcc… |
Fix summary
The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.
Patch summary
In app/Model/Server.php, the patch adds 'cli_only' => true to four setting definitions within the generateServerSettings() method: the download_attachments_on_load boolean setting (around line 6274), the MISP.redis_host string setting (around line 7037), the Plugin.ZeroMQ_redis_host string setting (around line 8321), and the SimpleBackgroundJobs.redis_host string setting (around line 9050). Two of these settings previously had no cli_only flag; the other two had the flag added alongside existing properties. The change totals 6 insertions and 2 deletions across the single file.
CVSS rationale
AV:N: The settings are modified via the web UI or API over the network. AC:H: Exploitation requires a prior session-compromise mechanism (e.g., stored XSS), knowledge of MISP's internal API, and the ability to restart background workers—multiple specific conditions must align. AT:N: No additional attack complexity beyond what AC captures. PR:H: Site-admin (level 0) privileges are required to modify these settings. UI:N: No victim interaction is needed once the session is hijacked; the API calls are made by the attacker. VC:N: No direct confidentiality impact on MISP itself. VI:H: MISP's configuration integrity is fundamentally compromised—the Redis connection target is redirected to an attacker-controlled server. VA:N: No direct availability impact on MISP. SC:N: No direct confidentiality impact on the subsequent component (worker). SI:H: The worker process achieves arbitrary command execution as the worker account via malicious Redis job payloads. SA:N: No availability impact on the subsequent component.
Weakness rationale
- CWE-284 The Redis host and attachment rendering settings were accessible for modification via the web UI/API by site-admin users, when they should have been restricted to CLI or server configuration only. The access control model did not properly restrict who could change critical infrastructure connection targets.
- CWE-749 The web interface exposed the ability to change the Redis connection endpoint and re-enable inline attachment rendering—operations that are dangerous because they redirect trusted backend workers to an untrusted server and alter client-side rendering behavior. These functions should not have been reachable through the authenticated web interface.
Attack pattern rationale
- CAPEC-126 The commit message explicitly identifies a 'hijacked site-admin session' as the prerequisite attack vector, and the exploitation path relies on an authenticated session making API/UI calls to modify configuration. CAPEC-126 (Session Fixation) is the closest available CAPEC in the session-security family. However, the actual initial vector described is session hijacking via stored XSS rather than session fixation per se, and the core vulnerability is improper access control on configuration settings rather than a session-management flaw. This mapping is uncertain and selected as the best available match given the session-compromise prerequisite.
- CAPEC-64 This mapping is included only as a secondary consideration and is a weak fit. The attack does not involve CRLF injection or HTTP splitting. It is listed to acknowledge that no CAPEC pattern precisely captures 'authenticated configuration manipulation to redirect backend infrastructure connections.' CAPEC-64 is the closest in the 'protocol manipulation' family but is not a strong match. This mapping is highly uncertain.
Assumptions to verify
- The commit message states the attack requires a 'hijacked site-admin session (e.g. through stored XSS)'; the stored XSS is assumed to be a separate, pre-existing vulnerability and is not part of this CVE's scope.
- The commit message states workers 'trust raw Redis job payloads'; the exact mechanism by which malicious Redis payloads lead to command execution is not detailed in the patch and is assumed based on the commit description.
- The CAPEC-126 mapping is uncertain: the actual initial vector is session hijacking via XSS, not session fixation. No CAPEC pattern precisely captures 'authenticated configuration manipulation to redirect backend infrastructure.' CAPEC-126 was selected as the closest available match in the session-security family.
- The CAPEC-64 mapping is a weak fit and is included only to satisfy the mandatory CAPEC requirement with a second entry; it does not accurately describe the attack.
- Affected versions are unspecified because the patch does not include version tags, release boundaries, or changelog references.
- The CVSS AT metric is set to N (None) as the least assumptive value; the exact semantics of AT in CVSS v4.0 relative to AC are not fully clarified in the available evidence.
- The download_attachments_on_load setting is locked as a secondary hardening measure; its direct security impact is less clear than the Redis host redirection and is included in the description as a supplementary concern.
- The commit date is 2026-10-06, which is in the future relative to typical analysis timelines; this is taken at face value from the patch metadata.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
4 | 11 | medium | 8 |
- 2026-10-06 18:25 UTC Fix developed Corrective change authored (2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6): fix: [security] Make redis host and attachment download https://github.com/MISP/MISP/commit/2ebf29f93.patch
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp_\\(malware_information_sharing_platform\\):*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Server settings (app/Model/Server.php)",
"MISP.redis_host",
"Plugin.ZeroMQ_redis_host",
"SimpleBackgroundJobs.redis_host",
"download_attachments_on_load"
],
"product": "MISP",
"programFiles": [
"app/Model/Server.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Logan Homolka"
},
{
"lang": "en",
"type": "reporter",
"value": "CERT.pl"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
},
{
"lang": "en",
"type": "coordinator",
"value": "CCB"
},
{
"lang": "en",
"type": "coordinator",
"value": "Alexandre Dulaunoy"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP exposes critical infrastructure settings\u2014specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin\u2014through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker\u0027s Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection.\u003c/p\u003e"
}
],
"value": "MISP exposes critical infrastructure settings\u2014specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin\u2014through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional validation. An attacker who obtains a hijacked site-admin session (for example, through a stored cross-site scripting vulnerability) can modify the Redis host settings to point at an attacker-controlled Redis server and then restart the workers. Once the workers connect to the attacker\u0027s Redis instance, the attacker can inject malicious job payloads that the workers execute, achieving arbitrary command execution as the worker account. Additionally, the download_attachments_on_load setting, which controls inline attachment rendering, was modifiable through the same interface, allowing a hijacked session to re-enable a feature that could facilitate further client-side attacks. The vulnerability requires site-admin privileges and a prior session-compromise mechanism; it does not require unauthenticated access. The impact is remote code execution in the context of the MISP worker process and potential data exfiltration through the attacker-controlled Redis connection."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Session Fixation"
}
]
},
{
"capecId": "CAPEC-64",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-64 HTTP Request/Response Splitting"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-06T18:56:14Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/2ebf29f93"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.\u003c/p\u003e"
}
],
"value": "The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "partial",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The commit message states the attack requires a \u0027hijacked site-admin session (e.g. through stored XSS)\u0027; the stored XSS is assumed to be a separate, pre-existing vulnerability and is not part of this CVE\u0027s scope.",
"The commit message states workers \u0027trust raw Redis job payloads\u0027; the exact mechanism by which malicious Redis payloads lead to command execution is not detailed in the patch and is assumed based on the commit description.",
"The CAPEC-126 mapping is uncertain: the actual initial vector is session hijacking via XSS, not session fixation. No CAPEC pattern precisely captures \u0027authenticated configuration manipulation to redirect backend infrastructure.\u0027 CAPEC-126 was selected as the closest available match in the session-security family.",
"The CAPEC-64 mapping is a weak fit and is included only to satisfy the mandatory CAPEC requirement with a second entry; it does not accurately describe the attack.",
"Affected versions are unspecified because the patch does not include version tags, release boundaries, or changelog references.",
"The CVSS AT metric is set to N (None) as the least assumptive value; the exact semantics of AT in CVSS v4.0 relative to AC are not fully clarified in the available evidence.",
"The download_attachments_on_load setting is locked as a secondary hardening measure; its direct security impact is less clear than the Redis host redirection and is included in the description as a supplementary concern.",
"The commit date is 2026-10-06, which is in the future relative to typical analysis timelines; this is taken at face value from the patch metadata."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The commit message explicitly identifies a \u0027hijacked site-admin session\u0027 as the prerequisite attack vector, and the exploitation path relies on an authenticated session making API/UI calls to modify configuration. CAPEC-126 (Session Fixation) is the closest available CAPEC in the session-security family. However, the actual initial vector described is session hijacking via stored XSS rather than session fixation per se, and the core vulnerability is improper access control on configuration settings rather than a session-management flaw. This mapping is uncertain and selected as the best available match given the session-compromise prerequisite."
},
{
"capecId": "CAPEC-64",
"rationale": "This mapping is included only as a secondary consideration and is a weak fit. The attack does not involve CRLF injection or HTTP splitting. It is listed to acknowledge that no CAPEC pattern precisely captures \u0027authenticated configuration manipulation to redirect backend infrastructure connections.\u0027 CAPEC-64 is the closest in the \u0027protocol manipulation\u0027 family but is not a strong match. This mapping is highly uncertain."
}
],
"commit": "2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Logan Homolka"
},
{
"lang": "en",
"type": "reporter",
"value": "CERT.pl"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N: The settings are modified via the web UI or API over the network. AC:H: Exploitation requires a prior session-compromise mechanism (e.g., stored XSS), knowledge of MISP\u0027s internal API, and the ability to restart background workers\u2014multiple specific conditions must align. AT:N: No additional attack complexity beyond what AC captures. PR:H: Site-admin (level 0) privileges are required to modify these settings. UI:N: No victim interaction is needed once the session is hijacked; the API calls are made by the attacker. VC:N: No direct confidentiality impact on MISP itself. VI:H: MISP\u0027s configuration integrity is fundamentally compromised\u2014the Redis connection target is redirected to an attacker-controlled server. VA:N: No direct availability impact on MISP. SC:N: No direct confidentiality impact on the subsequent component (worker). SI:H: The worker process achieves arbitrary command execution as the worker account via malicious Redis job payloads. SA:N: No availability impact on the subsequent component.",
"fixSummary": "The fix restricts the Redis host settings (MISP.redis_host, Plugin.ZeroMQ_redis_host, SimpleBackgroundJobs.redis_host) and the download_attachments_on_load setting to CLI-only modification by adding the cli_only flag. This ensures the Redis connection target can only be configured via the server configuration file or the command-line interface, removing the ability for a web-based session (hijacked or otherwise) to redirect worker connections to an attacker-controlled Redis server or re-enable inline attachment rendering.",
"generatedAt": "2026-10-06T18:56:14.991485Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 8,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 4
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "8262490f9bccf2a4bc3e35074b0798f0cbfeefc14e5e9fc876788ac1b09eabce",
"patchSummary": "In app/Model/Server.php, the patch adds \u0027cli_only\u0027 =\u003e true to four setting definitions within the generateServerSettings() method: the download_attachments_on_load boolean setting (around line 6274), the MISP.redis_host string setting (around line 7037), the Plugin.ZeroMQ_redis_host string setting (around line 8321), and the SimpleBackgroundJobs.redis_host string setting (around line 9050). Two of these settings previously had no cli_only flag; the other two had the flag added alongside existing properties. The change totals 6 insertions and 2 deletions across the single file.",
"patchTruncated": false,
"patches": [
{
"commit": "2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6",
"date": "Tue, 6 Oct 2026 20:25:04 +0200",
"patchSha256": "8262490f9bccf2a4bc3e35074b0798f0cbfeefc14e5e9fc876788ac1b09eabce",
"source": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
"subject": "fix: [security] Make redis host and attachment download"
}
],
"source": "https://github.com/MISP/MISP/commit/2ebf29f93.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "Supplier",
"timestamp": "2026-10-06T18:56:14Z",
"version": "2.0.3"
},
"subject": "fix: [security] Make redis host and attachment download",
"weaknessRationale": [
{
"cweId": "CWE-284",
"rationale": "The Redis host and attachment rendering settings were accessible for modification via the web UI/API by site-admin users, when they should have been restricted to CLI or server configuration only. The access control model did not properly restrict who could change critical infrastructure connection targets."
},
{
"cweId": "CWE-749",
"rationale": "The web interface exposed the ability to change the Redis connection endpoint and re-enable inline attachment rendering\u2014operations that are dangerous because they redirect trusted backend workers to an untrusted server and alter client-side rendering behavior. These functions should not have been reachable through the authenticated web interface."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (2ebf29f93dd83dbd30739432fd0a28f5d8ae81c6): fix: [security] Make redis host and attachment download",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/2ebf29f93.patch"
],
"timestamp": "2026-10-06T18:25:04Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20117"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-106513",
"datePublished": "2026-10-06T18:58:00.000Z",
"dateReserved": "2026-10-06T18:58:00.000Z",
"dateUpdated": "2026-10-06T19:03:57.387737Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20117"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-18901 (GCVE-0-2026-18901)
Vulnerability from cvelistv5 – Published: 2026-08-05 04:00 – Updated: 2026-08-05 14:27
VLAI
EPSS
VEX
Title
H3C NX15 Web API esps service.add routine
Summary
A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 13:17 UTC
CWE
- CWE-749 - Exposed Dangerous Routine
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385935 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385935/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18901 | third-party-advisory |
| https://vuldb.com/submit/857817 | third-party-advisory |
| https://github.com/coconut652-7/IOT_Vul_Public/tr… | related |
| https://github.com/coconut652-7/IOT_Vul_Public/bl… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18901",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:17:17.061662Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:27:47.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:h3c:nx15:*:*:*:*:*:*:*:*"
],
"modules": [
"Web API"
],
"product": "NX15",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "V100R017"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "coconut (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "Exposed Dangerous Routine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T04:00:10.979Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385935 | H3C NX15 Web API esps service.add routine",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385935"
},
{
"name": "VDB-385935 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385935/cti"
},
{
"name": "CVE-2026-18901 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18901"
},
{
"name": "Submit #857817 | H3C NX15 Router NX15V100R017 Command Execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/857817"
},
{
"tags": [
"related"
],
"url": "https://github.com/coconut652-7/IOT_Vul_Public/tree/main/H3C/NX15R017/service_add_root_rce_chain/report"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/coconut652-7/IOT_Vul_Public/blob/main/H3C/NX15R017/service_add_root_rce_chain/poc/postauth_service_add_rce.py"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-04T22:10:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "H3C NX15 Web API esps service.add routine",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18901",
"datePublished": "2026-08-05T04:00:10.979Z",
"dateReserved": "2026-08-04T20:05:16.930Z",
"dateUpdated": "2026-08-05T14:27:47.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18263 (GCVE-0-2026-18263)
Vulnerability from cvelistv5 – Published: 2026-08-20 16:26 – Updated: 2026-08-26 19:47
VLAI
EPSS
VEX
Title
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
Summary
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28886.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 19:40 UTC
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | RAS Client |
Affected:
21.0.26296
|
Date Public
2026-08-12 02:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:40:55.734019Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:47:56.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RAS Client",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "21.0.26296"
}
]
}
],
"dateAssigned": "2026-07-29T16:57:37.406Z",
"datePublic": "2026-08-12T02:22:32.997Z",
"descriptions": [
{
"lang": "en",
"value": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28886."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:26:03.077Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-26-556",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-556/"
}
],
"source": {
"lang": "en",
"value": "khongtrang"
},
"title": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2026-18263",
"datePublished": "2026-08-20T16:26:03.077Z",
"dateReserved": "2026-07-29T16:57:37.379Z",
"dateUpdated": "2026-08-26T19:47:56.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18262 (GCVE-0-2026-18262)
Vulnerability from cvelistv5 – Published: 2026-08-20 16:25 – Updated: 2026-08-21 20:08
VLAI
EPSS
VEX
Title
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
Summary
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28885.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:52 UTC
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | RAS Client |
Affected:
21.0.26296
|
Date Public
2026-08-12 02:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18262",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:52:29.751247Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T20:08:38.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RAS Client",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "21.0.26296"
}
]
}
],
"dateAssigned": "2026-07-29T16:57:03.463Z",
"datePublic": "2026-08-12T02:22:27.706Z",
"descriptions": [
{
"lang": "en",
"value": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28885."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:25:54.455Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-26-555",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-555/"
}
],
"source": {
"lang": "en",
"value": "khongtrang"
},
"title": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2026-18262",
"datePublished": "2026-08-20T16:25:54.455Z",
"dateReserved": "2026-07-29T16:57:03.365Z",
"dateUpdated": "2026-08-21T20:08:38.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14620 (GCVE-0-2026-14620)
Vulnerability from cvelistv5 – Published: 2026-07-03 17:00 – Updated: 2026-07-06 15:54
VLAI
EPSS
VEX
Title
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Summary
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-06 15:54 UTC
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webpack-dev-server | webpack-dev-server |
Affected:
0 , < 5.2.6
(semver)
Unaffected: 5.2.6 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T15:54:37.670158Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T15:54:51.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/webpack-dev-server",
"product": "webpack-dev-server",
"vendor": "webpack-dev-server",
"versions": [
{
"lessThan": "5.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.2.6",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pig-Tail"
},
{
"lang": "en",
"type": "coordinator",
"value": "bjohansebas"
},
{
"lang": "en",
"type": "analyst",
"value": "UlisesGascon"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server\u0027s own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer\u0027s editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer\u0027s machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none."
}
],
"value": "webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server\u0027s own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer\u0027s editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer\u0027s machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-03T17:00:00.679Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"url": "https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints",
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-14620",
"datePublished": "2026-07-03T17:00:00.679Z",
"dateReserved": "2026-07-03T16:50:55.559Z",
"dateUpdated": "2026-07-06T15:54:51.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13121 (GCVE-0-2026-13121)
Vulnerability from cvelistv5 – Published: 2026-08-20 16:25 – Updated: 2026-08-21 20:08
VLAI
EPSS
VEX
Title
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
Summary
Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29220.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:52 UTC
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | RAS Client |
Affected:
21.0.26296
|
Date Public
2026-08-12 02:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:52:37.373703Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T20:08:39.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RAS Client",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "21.0.26296"
}
]
}
],
"dateAssigned": "2026-06-23T22:08:03.627Z",
"datePublic": "2026-08-12T02:22:21.897Z",
"descriptions": [
{
"lang": "en",
"value": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the RAS RDP Backend Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29220."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:25:44.565Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-26-554",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-554/"
}
],
"source": {
"lang": "en",
"value": "khongtrang"
},
"title": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2026-13121",
"datePublished": "2026-08-20T16:25:44.565Z",
"dateReserved": "2026-06-23T22:08:03.592Z",
"dateUpdated": "2026-08-21T20:08:39.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12060 (GCVE-0-2026-12060)
Vulnerability from cvelistv5 – Published: 2026-06-12 06:43 – Updated: 2026-09-29 07:18
VLAI
EPSS
VEX
Title
Hepta Platforms｜Heptabase - Exposed Dangerous
Summary
Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining unauthorized access to camera and microphone permissions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-12 13:52 UTC
CWE
- CWE-749 - Exposed dangerous method or function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-10968-6be4c-1.html | third-party-advisory |
| https://www.twcert.org.tw/en/cp-139-10967-4947d-2.html | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hepta Platforms | Heptabase |
Affected:
0 , < 1.90.5
(custom)
|
Date Public
2026-06-12 06:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12060",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-12T13:52:35.566560Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T13:54:04.105Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Heptabase",
"vendor": "Hepta Platforms",
"versions": [
{
"lessThan": "1.90.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-06-12T06:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining unauthorized access to camera and microphone permissions."
}
],
"value": "Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining unauthorized access to camera and microphone permissions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed dangerous method or function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T07:18:46.476Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-10968-6be4c-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-10967-4947d-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u0026nbsp;Please update to version 1.90.5 or later."
}
],
"value": "Please update to version 1.90.5 or later."
}
],
"source": {
"advisory": "TVN-202606003",
"discovery": "EXTERNAL"
},
"title": "Hepta Platforms\uff5cHeptabase - Exposed Dangerous",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2026-12060",
"datePublished": "2026-06-12T06:43:35.337Z",
"dateReserved": "2026-06-12T06:01:43.245Z",
"dateUpdated": "2026-09-29T07:18:46.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8109 (GCVE-0-2026-8109)
Vulnerability from cvelistv5 – Published: 2026-05-12 14:29 – Updated: 2026-05-12 18:58
VLAI
EPSS
VEX
Summary
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 18:58 UTC
CWE
- CWE-749 - Exposed dangerous method or function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ivanti | Endpoint Manager |
Unaffected:
2024 SU6
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T18:58:46.940751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T18:58:58.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Endpoint Manager",
"vendor": "ivanti",
"versions": [
{
"status": "unaffected",
"version": "2024 SU6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An exposed dangerous method\u0026nbsp;on\u0026nbsp;the Core Server of\u0026nbsp;Ivanti Endpoint Manager\u0026nbsp;before\u0026nbsp;version\u0026nbsp;2024 SU6\u0026nbsp;allows a\u0026nbsp;remote authenticated\u0026nbsp;attacker to\u0026nbsp;leak access credentials.\u0026nbsp;"
}
],
"value": "An exposed dangerous method\u00a0on\u00a0the Core Server of\u00a0Ivanti Endpoint Manager\u00a0before\u00a0version\u00a02024 SU6\u00a0allows a\u00a0remote authenticated\u00a0attacker to\u00a0leak access credentials."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749 Exposed dangerous method or function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T14:29:10.500Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-May-2026?language=en_US"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-8109",
"datePublished": "2026-05-12T14:29:10.500Z",
"dateReserved": "2026-05-07T16:20:42.642Z",
"dateUpdated": "2026-05-12T18:58:58.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8108 (GCVE-0-2026-8108)
Vulnerability from cvelistv5 – Published: 2026-05-12 22:29 – Updated: 2026-05-13 01:39
VLAI
EPSS
VEX
Title
Fuji Electric Tellus Exposed Dangerous Method or Function
Summary
The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 01:38 UTC
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Tellus |
Affected:
5.0.2
|
Date Public
2026-05-12 22:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T01:38:52.768933Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T01:39:00.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tellus",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "5.0.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kim Myung-gyu of Trend Micro Zero Day Initiative reported this vulnerability to CISA."
}
],
"datePublic": "2026-05-12T22:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions."
}
],
"value": "The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T22:29:53.239Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-132-01.json"
}
],
"source": {
"advisory": "ICSA-26-132-01",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Tellus Exposed Dangerous Method or Function",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric recommends that Tellus be installed only with administrator privileges."
}
],
"value": "Fuji Electric recommends that Tellus be installed only with administrator privileges."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-8108",
"datePublished": "2026-05-12T22:29:53.239Z",
"dateReserved": "2026-05-07T15:18:17.964Z",
"dateUpdated": "2026-05-13T01:39:00.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7516 (GCVE-0-2026-7516)
Vulnerability from cvelistv5 – Published: 2026-06-10 14:08 – Updated: 2026-06-10 16:04
VLAI
EPSS
VEX
Summary
A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 16:04 UTC
CWE
- CWE-749 - Exposed Dangerous Method or Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://iknow.lenovo.com.cn/detail/440821 | vendor-advisory |
| https://shop.lenovo.com.cn/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Application |
Affected:
0 , < 7.3.8
(custom)
cpe:2.3:a:lenovo:application:*:*:android:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7516",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T16:04:17.701084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T16:04:24.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "Application",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "7.3.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:application:*:*:android:*:*:*:*:*",
"versionEndExcluding": "7.3.8",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Xinfeng Chen \u9648\u946b\u5cf0 and Mingming Wan \u4e07\u660e\u660e from Geely Zero Lab at Geely Auto for reporting this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents."
}
],
"value": "A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T14:08:47.203Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://iknow.lenovo.com.cn/detail/440821"
},
{
"tags": [
"product"
],
"url": "https://shop.lenovo.com.cn/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate Lenovo Application for Android to version 7.3.8 or later.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Update Lenovo Application for Android to version 7.3.8 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-7516",
"datePublished": "2026-06-10T14:08:47.203Z",
"dateReserved": "2026-04-30T16:01:06.878Z",
"dateUpdated": "2026-06-10T16:04:24.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.
Mitigation
Architecture and Design
Implementation
Strategy: Attack Surface Reduction
- Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be:
- Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.
- accessible to all users
- restricted to a small set of privileged users
- prevented from being directly accessible at all
CAPEC-500: WebView Injection
An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component. Through the injected code, an adversary is able to manipulate the DOM tree and cookies of the page, expose sensitive information, and can launch attacks against the web application from within the web page.