Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "sharpemu",
          "vendor": "sharpemu",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.0.3-release.3-patch.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its \u00a0do_POST\u00a0 handler in \u00a0tools/SharpEmu.DebuggerFrontend/debugger_frontend.py\u00a0 does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The \u00a0_read_json_body()\u00a0 function also accepts JSON sent with browser-simple content types instead of requiring \u00a0application/json\u00a0. A malicious page that can reach the loopback listener can send cross-origin requests to \u00a0/api/launch\u00a0, \u00a0/api/command\u00a0, and \u00a0/api/connect\u00a0. Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The \u00a0/api/launch\u00a0 endpoint accepts an attacker-selected \u00a0emulatorPath\u00a0 if it points to an existing file on the victim\u2019s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing \u00a0ebootPath\u00a0. The \u00a0/api/command\u00a0 endpoint exposes debugger operations, including \u00a0write-memory\u00a0, \u00a0set-register\u00a0, and \u00a0continue\u00a0. The \u00a0/api/connect\u00a0 endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim\u2019s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-350",
              "description": "CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T15:24:16.625Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3"
        },
        {
          "name": "https://github.com/sharpemu/sharpemu/pull/858",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sharpemu/sharpemu/pull/858"
        },
        {
          "name": "https://github.com/sharpemu/sharpemu/commit/3831f3c407c547a5e58f353649b2c556d785c463",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sharpemu/sharpemu/commit/3831f3c407c547a5e58f353649b2c556d785c463"
        },
        {
          "name": "https://github.com/sharpemu/sharpemu/releases/tag/v0.0.3-release.3-patch.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sharpemu/sharpemu/releases/tag/v0.0.3-release.3-patch.1"
        }
      ],
      "source": {
        "advisory": "GHSA-fr3v-rvqp-8fx3",
        "discovery": "UNKNOWN"
      },
      "title": "SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-92704",
    "datePublished": "2026-11-04T15:24:16.625Z",
    "dateReserved": "2026-09-16T16:22:31.542Z",
    "dateUpdated": "2026-11-04T15:24:16.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.29.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to 0.29.0, the Kubernetes protocol listener uses AcceptAnyClientCert in warpgate-protocol-kubernetes/src/server/client_certs.rs to accept certificates at the TLS layer and defer validation to warpgate-protocol-kubernetes/src/server/auth.rs, where authentication and lookup failures are rendered verbatim in an HTTP 500 response body. The Kubernetes application in warpgate-protocol-kubernetes/src/server/mod.rs lacks the outer request-logging wrapper used by the HTTP protocol, and failures in warpgate-protocol-kubernetes/src/server/handlers.rs can short-circuit before its inner log point. An unauthenticated network client can therefore induce failures and receive ASN.1/DER parser diagnostics or sea_orm database errors without the attempt being recorded in the gateway log. The disclosed information is limited to internal diagnostics, and no user-data, integrity, or availability impact is established. This issue is fixed in version 0.29.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T15:19:15.511Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-hrfx-fm67-gv64"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/pull/2547",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/pull/2547"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/8426196a27c30fca521656653f9df1faf3df7523"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0"
        }
      ],
      "source": {
        "advisory": "GHSA-hrfx-fm67-gv64",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91163",
    "datePublished": "2026-11-04T15:19:15.511Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-11-04T15:19:15.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "warpgate",
          "vendor": "warp-tech",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.21.0, \u003c 0.29.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, target_name, and client IP rather than by the immutable user UUID, while KubernetesSessionHandle::close does not evict the entry. If an account is deleted and a different low-privilege account is created with the same username, the replacement account can successfully authenticate as that recreated username and reuse the predecessor\u0027s still-live correlation entry when requesting the same target from the same client IP before kubernetes.session_max_age expires. Current-request authentication still occurs, but the reused entry bypasses a fresh target authorization check and can cause Warpgate to proxy requests with Kubernetes target credentials that the replacement account is not authorized to use, exposing cluster resources or permitting unauthorized mutations. This issue is fixed in version 0.29.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T15:17:23.805Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-pw7m-635x-pmx7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-pw7m-635x-pmx7"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/commit/2f77f07b8335ff495068aa10d650d4b314bf4cc8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/commit/2f77f07b8335ff495068aa10d650d4b314bf4cc8"
        },
        {
          "name": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/warp-tech/warpgate/releases/tag/v0.29.0"
        }
      ],
      "source": {
        "advisory": "GHSA-pw7m-635x-pmx7",
        "discovery": "UNKNOWN"
      },
      "title": "Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-91168",
    "datePublished": "2026-11-04T15:17:23.805Z",
    "dateReserved": "2026-09-14T21:20:41.196Z",
    "dateUpdated": "2026-11-04T15:17:23.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "git-for-windows",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.43.0.windows.1, \u003c 2.55.0.windows.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T15:12:10.794Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"
        },
        {
          "name": "https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756"
        },
        {
          "name": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"
        }
      ],
      "source": {
        "advisory": "GHSA-5j7x-r6vf-jhq2",
        "discovery": "UNKNOWN"
      },
      "title": "Git for Windows: git-credential-wincred Erase Path Heap Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-100408",
    "datePublished": "2026-11-04T15:12:10.794Z",
    "dateReserved": "2026-09-25T20:08:33.084Z",
    "dateUpdated": "2026-11-04T15:12:10.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "git",
          "vendor": "git-for-windows",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.44.0.windows.1, \u003c 2.55.0.windows.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T15:07:59.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"
        },
        {
          "name": "https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d"
        },
        {
          "name": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"
        }
      ],
      "source": {
        "advisory": "GHSA-v3h4-vrpr-rh9x",
        "discovery": "UNKNOWN"
      },
      "title": "Git for Windows: git-credential-wincred OAuth Store Heap Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-100407",
    "datePublished": "2026-11-04T15:07:59.401Z",
    "dateReserved": "2026-09-25T20:08:33.084Z",
    "dateUpdated": "2026-11-04T15:07:59.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 21.2.0, \u003c 21.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:58:04.630Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh"
        },
        {
          "name": "https://github.com/angular/angular/issues/70908",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/issues/70908"
        },
        {
          "name": "https://github.com/angular/angular/pull/70953",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/70953"
        },
        {
          "name": "https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a"
        },
        {
          "name": "https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v21.2.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v21.2.25"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v22.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v22.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-57xq-rjx2-v5xh",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-111751",
    "datePublished": "2026-11-03T20:58:04.630Z",
    "dateReserved": "2026-10-16T17:52:09.081Z",
    "dateUpdated": "2026-11-03T20:58:04.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T21:23:29.234599Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:23:55.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.3.33"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router\u0027s final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:55:11.497Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-w739-gvwx-grc3"
        },
        {
          "name": "https://github.com/angular/angular/issues/71076",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/issues/71076"
        },
        {
          "name": "https://github.com/angular/angular/pull/71077",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/71077"
        },
        {
          "name": "https://github.com/angular/angular/pull/71078",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/71078"
        },
        {
          "name": "https://github.com/angular/angular/pull/71079",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/71079"
        },
        {
          "name": "https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/450af9c813c7660b9bd91e5635f705ee3ed7b32a"
        },
        {
          "name": "https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/83944fc8c50e86be90e8ec4184cd15002b5af262"
        },
        {
          "name": "https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/928dcfd2582152655b5559509d057bf6a5a19521"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v20.3.33",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v20.3.33"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v21.2.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v21.2.25"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v22.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v22.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-w739-gvwx-grc3",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-111754",
    "datePublished": "2026-11-03T20:55:11.497Z",
    "dateReserved": "2026-10-16T17:52:09.081Z",
    "dateUpdated": "2026-11-03T21:23:55.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.3.33"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-405",
              "description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:52:16.675Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"
        },
        {
          "name": "https://github.com/angular/angular/issues/70932",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/issues/70932"
        },
        {
          "name": "https://github.com/angular/angular/issues/70997",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/issues/70997"
        },
        {
          "name": "https://github.com/angular/angular/pull/71055",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/71055"
        },
        {
          "name": "https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c"
        },
        {
          "name": "https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0"
        },
        {
          "name": "https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v20.3.33",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v20.3.33"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v21.2.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v21.2.25"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v22.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v22.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-62vg-58rm-qff7",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-111752",
    "datePublished": "2026-11-03T20:52:16.675Z",
    "dateReserved": "2026-10-16T17:52:09.081Z",
    "dateUpdated": "2026-11-03T20:52:16.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:36:13.686987Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:39:17.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "silverstripe-mfa",
          "vendor": "silverstripe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user\u0027s configured multi-factor authentication challenge is completed. An attacker with access to the user\u0027s email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:48:32.218Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/silverstripe/silverstripe-mfa/security/advisories/GHSA-68wq-phq7-p2vg"
        },
        {
          "name": "https://github.com/silverstripe/silverstripe-framework/pull/11686",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/silverstripe/silverstripe-framework/pull/11686"
        },
        {
          "name": "https://github.com/silverstripe/silverstripe-mfa/pull/603",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/silverstripe/silverstripe-mfa/pull/603"
        },
        {
          "name": "https://github.com/silverstripe/silverstripe-framework/commit/4b5cbd7ddf68721d8119583f0b9c04d4b4adc704",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/silverstripe/silverstripe-framework/commit/4b5cbd7ddf68721d8119583f0b9c04d4b4adc704"
        },
        {
          "name": "https://github.com/silverstripe/silverstripe-mfa/commit/04a102b662ac2f555acc26f8d2e2d8dab3937a6a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/silverstripe/silverstripe-mfa/commit/04a102b662ac2f555acc26f8d2e2d8dab3937a6a"
        },
        {
          "name": "https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/silverstripe/silverstripe-mfa/releases/tag/6.0.0"
        },
        {
          "name": "https://www.silverstripe.org/download/security-releases/cve-2026-55186",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.silverstripe.org/download/security-releases/cve-2026-55186"
        }
      ],
      "source": {
        "advisory": "GHSA-68wq-phq7-p2vg",
        "discovery": "UNKNOWN"
      },
      "title": "Silverstripe MFA: Can bypass MFA during password reset flow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55186",
    "datePublished": "2026-11-03T20:48:32.218Z",
    "dateReserved": "2026-06-16T15:20:43.086Z",
    "dateUpdated": "2026-11-03T22:39:17.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "terragrunt",
          "vendor": "gruntwork-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim\u0027s security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-377",
              "description": "CWE-377: Insecure Temporary File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:44:04.616Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m"
        },
        {
          "name": "https://github.com/gruntwork-io/terragrunt/pull/6438",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gruntwork-io/terragrunt/pull/6438"
        },
        {
          "name": "https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a"
        },
        {
          "name": "https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1"
        }
      ],
      "source": {
        "advisory": "GHSA-wv6g-x823-wx9m",
        "discovery": "UNKNOWN"
      },
      "title": "Terragrunt catalog predictable temp symlink clobber"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64672",
    "datePublished": "2026-11-03T20:44:04.616Z",
    "dateReserved": "2026-07-20T17:12:12.891Z",
    "dateUpdated": "2026-11-03T20:44:04.616Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T21:26:42.883505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:26:55.431Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "effect",
          "vendor": "Effect-TS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-beta.0, \u003c 4.0.0-beta.103"
            }
          ]
        },
        {
          "product": "platform",
          "vendor": "@effect",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.0, \u003c 0.97.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie\u0027s scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:40:19.864Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Effect-TS/effect/security/advisories/GHSA-chp3-j5qr-2vfr"
        },
        {
          "name": "https://github.com/Effect-TS/effect/pull/6763",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Effect-TS/effect/pull/6763"
        },
        {
          "name": "https://github.com/Effect-TS/effect/pull/6765",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Effect-TS/effect/pull/6765"
        },
        {
          "name": "https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Effect-TS/effect/commit/4a57af24011db1d66e947289d2f7ffc2074696d2"
        },
        {
          "name": "https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Effect-TS/effect/commit/5859b373b9be04d5037a594196b4743ad80379bd"
        },
        {
          "name": "https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Effect-TS/effect/releases/tag/@effect/platform@0.97.1"
        },
        {
          "name": "https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Effect-TS/effect/releases/tag/effect@4.0.0-beta.103"
        }
      ],
      "source": {
        "advisory": "GHSA-chp3-j5qr-2vfr",
        "discovery": "UNKNOWN"
      },
      "title": "Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-115779",
    "datePublished": "2026-11-03T20:40:19.864Z",
    "dateReserved": "2026-10-23T13:28:51.847Z",
    "dateUpdated": "2026-11-03T21:26:55.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ckan-mcp-server",
          "vendor": "ondata",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.112"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-940",
              "description": "CWE-940: Improper Verification of Source of a Communication Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:33:35.548Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-vqff-r82h-9crc"
        },
        {
          "name": "https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5"
        },
        {
          "name": "https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112"
        }
      ],
      "source": {
        "advisory": "GHSA-vqff-r82h-9crc",
        "discovery": "UNKNOWN"
      },
      "title": "CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin \"*\" (out)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76894",
    "datePublished": "2026-11-03T20:33:35.548Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-11-03T20:33:35.548Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:36:42.446948Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:39:36.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "stanza",
          "vendor": "stanfordnlp",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:26:02.220Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5"
        },
        {
          "name": "https://github.com/stanfordnlp/stanza/pull/1649",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stanfordnlp/stanza/pull/1649"
        },
        {
          "name": "https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0"
        },
        {
          "name": "https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0"
        }
      ],
      "source": {
        "advisory": "GHSA-gh9r-c94j-cmp5",
        "discovery": "UNKNOWN"
      },
      "title": "Stanza: RCE via pickle deserialization in the lemmatizer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-115878",
    "datePublished": "2026-11-03T20:26:02.220Z",
    "dateReserved": "2026-10-23T19:37:27.176Z",
    "dateUpdated": "2026-11-03T22:39:36.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.42.0, \u003c 2.180.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:11:38.816Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/pull/1580",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/pull/1580"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xggf-m53x-jc3f",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-95860",
    "datePublished": "2026-11-03T20:11:38.816Z",
    "dateReserved": "2026-09-22T16:39:45.795Z",
    "dateUpdated": "2026-11-03T20:11:38.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T21:29:03.036554Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:29:17.279Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "claude-code",
          "vendor": "anthropics",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:08:47.362Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv"
        },
        {
          "name": "https://github.com/anthropics/claude-code/releases/tag/v2.1.251",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/anthropics/claude-code/releases/tag/v2.1.251"
        }
      ],
      "source": {
        "advisory": "GHSA-5xjx-9qx6-jcrv",
        "discovery": "UNKNOWN"
      },
      "title": "Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-88968",
    "datePublished": "2026-11-03T20:08:47.362Z",
    "dateReserved": "2026-09-10T16:02:31.341Z",
    "dateUpdated": "2026-11-03T21:29:17.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "claude-code",
          "vendor": "anthropics",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8089.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Claude Desktop is Anthropic\u0027s desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project\u0027s current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user\u0027s privileges. This issue is fixed in version 1.8089.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T20:07:52.495Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84"
        }
      ],
      "source": {
        "advisory": "GHSA-4p2j-qj3c-6x84",
        "discovery": "UNKNOWN"
      },
      "title": "Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-88066",
    "datePublished": "2026-11-03T20:07:52.495Z",
    "dateReserved": "2026-09-09T21:22:45.435Z",
    "dateUpdated": "2026-11-03T20:07:52.495Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-03T20:10:30.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/01/10"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54161",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:36:38.962299Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:39:49.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nut",
          "vendor": "networkupstools",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.8.3, \u003c= 2.8.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:57:14.274Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5"
        },
        {
          "name": "https://github.com/networkupstools/nut/pull/3499",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/networkupstools/nut/pull/3499"
        },
        {
          "name": "https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7"
        },
        {
          "name": "https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a"
        },
        {
          "name": "https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220"
        }
      ],
      "source": {
        "advisory": "GHSA-mjgp-j4gm-6qg5",
        "discovery": "UNKNOWN"
      },
      "title": "upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54161",
    "datePublished": "2026-11-03T19:57:14.274Z",
    "dateReserved": "2026-06-11T21:46:52.380Z",
    "dateUpdated": "2026-11-03T22:39:49.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "chamilo-lms",
          "vendor": "chamilo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.40"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:54:46.162Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40"
        },
        {
          "name": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-prqp-8x29-cr88",
        "discovery": "UNKNOWN"
      },
      "title": "Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45146",
    "datePublished": "2026-11-03T19:54:46.162Z",
    "dateReserved": "2026-05-08T20:44:38.963Z",
    "dateUpdated": "2026-11-03T19:54:46.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MyTube",
          "vendor": "franklioxygen",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey value rather than successful API-key validation. With a permissive CORS_ALLOWED_ORIGINS configuration, an unauthenticated attacker can lure an authenticated administrator to attacker-controlled content that sends a cross-origin state-changing request with an arbitrary API-key value. The victim\u0027s session cookie authenticates the request while CSRF token validation is skipped, allowing destructive or other administrator API operations such as deleting media, triggering downloads, or changing subscriptions. This issue is fixed in version 1.10.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:52:42.475Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-9qxv-p8j9-gv5r"
        },
        {
          "name": "https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/franklioxygen/MyTube/commit/b2000d8b239fd2e44b0e6160137c8b636a09cc89"
        }
      ],
      "source": {
        "advisory": "GHSA-9qxv-p8j9-gv5r",
        "discovery": "UNKNOWN"
      },
      "title": "MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63433",
    "datePublished": "2026-11-03T19:52:42.475Z",
    "dateReserved": "2026-07-16T19:35:57.766Z",
    "dateUpdated": "2026-11-03T19:52:42.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:36:09.377087Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:39:55.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MyTube",
          "vendor": "franklioxygen",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, when statisticsEnabled and statisticsTrackVisitorActivity are enabled, a visitor-role user can submit events to the statistics ingest endpoint handled by ingestEvents in backend/src/controllers/statisticsController.ts. The handler reads req.body.events and accepts the client-controlled platform, sourceKind, and sessionId fields without server-side derivation or validation before passing the events to the analytics persistence path. A visitor can therefore attribute fabricated events to arbitrary platforms, sources, and sessions, corrupting administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics. The server-derived actorRole and surface fields are not forgeable through this issue. This issue is fixed in version 1.10.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:51:04.967Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-h5xx-g8fc-crr7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/franklioxygen/MyTube/security/advisories/GHSA-h5xx-g8fc-crr7"
        },
        {
          "name": "https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/franklioxygen/MyTube/commit/5cfbc22166de64dfb65cb789ef00909dd48783d7"
        },
        {
          "name": "https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/franklioxygen/MyTube/commit/60424529121018cbf0481034a97fca36d3bc5c66"
        },
        {
          "name": "https://github.com/franklioxygen/MyTube/commit/d65913a9319dd840ab2ac77565325cf701306d6d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/franklioxygen/MyTube/commit/d65913a9319dd840ab2ac77565325cf701306d6d"
        },
        {
          "name": "https://github.com/franklioxygen/MyTube/releases/tag/v1.10.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/franklioxygen/MyTube/releases/tag/v1.10.6"
        }
      ],
      "source": {
        "advisory": "GHSA-h5xx-g8fc-crr7",
        "discovery": "UNKNOWN"
      },
      "title": "MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63434",
    "datePublished": "2026-11-03T19:51:04.967Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-03T22:39:55.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63395",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T21:29:42.766185Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:30:11.615Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.38.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git\u0027s git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:48:11.232Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/pull/2370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2370"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"
        }
      ],
      "source": {
        "advisory": "GHSA-9qw7-j9xw-fv9c",
        "discovery": "UNKNOWN"
      },
      "title": "isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63395",
    "datePublished": "2026-11-03T19:48:11.232Z",
    "dateReserved": "2026-07-16T17:39:30.171Z",
    "dateUpdated": "2026-11-03T21:30:11.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63475",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T21:30:35.793171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:31:07.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.38.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:45:24.488Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/pull/2370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2370"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"
        }
      ],
      "source": {
        "advisory": "GHSA-96wc-2m84-2cj7",
        "discovery": "UNKNOWN"
      },
      "title": "isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63475",
    "datePublished": "2026-11-03T19:45:24.488Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-03T21:31:07.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.38.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloc(targetSize). A malicious or man-in-the-middle-controlled remote can send one delta header that causes git.clone() or git.fetch() to allocate approximately 2 GB before validating the actual delta output. GitPackIndex.fromPack swallows the later size-mismatch error, so a host with sufficient memory may retain the resource waste without a visible failure, while containers, serverless functions, and small virtual machines may terminate. Node.js heap limits do not mitigate the off-heap Buffer allocation. This issue is fixed in version 1.38.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:44:06.908Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9x82-4j54-863h"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/pull/2370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2370"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"
        }
      ],
      "source": {
        "advisory": "GHSA-9x82-4j54-863h",
        "discovery": "UNKNOWN"
      },
      "title": "isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63476",
    "datePublished": "2026-11-03T19:44:06.908Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-03T19:44:06.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "isomorphic-git",
          "vendor": "isomorphic-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.38.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git\u0027s tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:39:52.188Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-cw2g-2vwq-88w6"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/pull/2370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/pull/2370"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"
        },
        {
          "name": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"
        }
      ],
      "source": {
        "advisory": "GHSA-cw2g-2vwq-88w6",
        "discovery": "UNKNOWN"
      },
      "title": "isomorphic-git: Path traversal via a \"..\" tree-entry name writes files outside the working directory on clone/checkout"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63478",
    "datePublished": "2026-11-03T19:39:52.188Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-03T19:39:52.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:36:07.474697Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:40:05.658Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:37:01.798Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/pull/1279",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/pull/1279"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6xf2-8436-rgvf",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63500",
    "datePublished": "2026-11-03T19:37:01.798Z",
    "dateReserved": "2026-07-16T21:49:52.069Z",
    "dateUpdated": "2026-11-03T22:40:05.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account\u0027s filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:36:06.607Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/pull/1280",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/pull/1280"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4q3w-w2g5-8wqq",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63502",
    "datePublished": "2026-11-03T19:36:06.607Z",
    "dateReserved": "2026-07-16T21:49:52.069Z",
    "dateUpdated": "2026-11-03T19:36:06.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63482",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:37:08.956502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:40:17.683Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:35:13.496Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/pull/1276",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/pull/1276"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-34r4-95hx-gxqr",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63482",
    "datePublished": "2026-11-03T19:35:13.496Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-03T22:40:17.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "yeti",
          "vendor": "yeti-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:33:57.975Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/pull/1277",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/pull/1277"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6"
        },
        {
          "name": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yeti-platform/yeti/releases/tag/2.5.1"
        }
      ],
      "source": {
        "advisory": "GHSA-vw33-fwfx-6m9p",
        "discovery": "UNKNOWN"
      },
      "title": "Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63489",
    "datePublished": "2026-11-03T19:33:57.975Z",
    "dateReserved": "2026-07-16T21:49:52.068Z",
    "dateUpdated": "2026-11-03T19:33:57.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63501",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T21:31:51.692243Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T21:32:16.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-6w3r-6hpr-hp6p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ag-psd",
          "vendor": "Agamnentzar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 31.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:30:03.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-6w3r-6hpr-hp6p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-6w3r-6hpr-hp6p"
        },
        {
          "name": "https://github.com/Agamnentzar/ag-psd/commit/57ea7d865238b6b7c8a2e976bcf2a77e03116e2f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Agamnentzar/ag-psd/commit/57ea7d865238b6b7c8a2e976bcf2a77e03116e2f"
        },
        {
          "name": "https://github.com/Agamnentzar/ag-psd/releases/tag/31.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Agamnentzar/ag-psd/releases/tag/31.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-6w3r-6hpr-hp6p",
        "discovery": "UNKNOWN"
      },
      "title": "ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63501",
    "datePublished": "2026-11-03T19:30:03.984Z",
    "dateReserved": "2026-07-16T21:49:52.069Z",
    "dateUpdated": "2026-11-03T21:32:16.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "fastapi-code-generator",
          "vendor": "koxudaxi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application\u0027s or CI process\u0027s privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project\u0027s separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:18:44.111Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp"
        },
        {
          "name": "https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc"
        },
        {
          "name": "https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332"
        },
        {
          "name": "https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1"
        }
      ],
      "source": {
        "advisory": "GHSA-p2mm-64f6-gmpp",
        "discovery": "UNKNOWN"
      },
      "title": "fastapi-code-generator: Import-time RCE via route path -\u003e unescaped @app.get(\u0027...\u0027) decorator"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63471",
    "datePublished": "2026-11-03T19:18:44.111Z",
    "dateReserved": "2026-07-16T21:37:45.769Z",
    "dateUpdated": "2026-11-03T19:18:44.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}