Search
Find a vulnerability
Search criteria
7 vulnerabilities
CVE-2026-129427 (GCVE-0-2026-129427)
Vulnerability from cvelistv5 – Published: 2026-11-14 11:19 – Updated: 2026-11-14 11:19
VLAI
EPSS
VEX
Title
Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO
Summary
Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO
in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges
Severity
8.7 (High)
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.grayback.es/advisories | patch |
| https://www.grayback.es/en/advisories | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CervantesSec | cervantes |
Affected:
alpha 0.3 , ≤ 1.3-beta
(custom)
Unaffected: v.1.4.0-beta cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cervantes",
"vendor": "CervantesSec",
"versions": [
{
"lessThanOrEqual": "1.3-beta",
"status": "affected",
"version": "alpha 0.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "v.1.4.0-beta"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3-beta",
"versionStartIncluding": "alpha_0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Miguel Segovia Gil"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO\nin Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user\u0027s browser with elevated privileges"
}
],
"value": "Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO\nin Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user\u0027s browser with elevated privileges"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T11:19:54.038Z",
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/advisories"
},
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/en/advisories"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"assignerShortName": "Grayback",
"cveId": "CVE-2026-129427",
"datePublished": "2026-11-14T11:19:54.038Z",
"dateReserved": "2026-11-14T11:12:40.073Z",
"dateUpdated": "2026-11-14T11:19:54.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126815 (GCVE-0-2026-126815)
Vulnerability from cvelistv5 – Published: 2026-11-11 20:10 – Updated: 2026-11-11 20:10
VLAI
EPSS
VEX
Title
Pre-account hijacking via planted password
Summary
Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.
Severity
8.1 (High)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.grayback.es/advisories | patch |
| https://www.grayback.es/en/advisories | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| XauenDevs | Lagarto Chivato |
Affected:
0.1.0 , ≤ 0.4.2
(custom)
Unaffected: 0.4.4 cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Lagarto Chivato",
"vendor": "XauenDevs",
"versions": [
{
"lessThanOrEqual": "0.4.2",
"status": "affected",
"version": "0.1.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.4.4"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.4.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:0.4.4:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hidalgo (hidalg0d)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim\u2019s first passwordless login."
}
],
"value": "Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim\u2019s first passwordless login."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T20:10:36.118Z",
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/advisories"
},
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/en/advisories"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Pre-account hijacking via planted password",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"assignerShortName": "Grayback",
"cveId": "CVE-2026-126815",
"datePublished": "2026-11-11T20:10:36.118Z",
"dateReserved": "2026-11-11T20:02:32.040Z",
"dateUpdated": "2026-11-11T20:10:36.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126784 (GCVE-0-2026-126784)
Vulnerability from cvelistv5 – Published: 2026-11-11 19:32 – Updated: 2026-11-11 19:32
VLAI
EPSS
VEX
Title
Uncontrolled resource consumption via post_notice
Summary
Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.
Severity
4.3 (Medium)
CWE
- CWE-770 - Allocation of resources without limits or throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.grayback.es/advisories | patch |
| https://www.grayback.es/en/advisories | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| XauenDevs | Lagarto Chivato |
Affected:
0.1.0 , ≤ 0.4.1
(custom)
Unaffected: 0.4.4 cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Lagarto Chivato",
"vendor": "XauenDevs",
"versions": [
{
"lessThanOrEqual": "0.4.1",
"status": "affected",
"version": "0.1.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "0.4.4"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.4.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xauendevs:lagarto_chivato:0.4.4:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "m1w34p0n"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing rate limiting, per-account submission quota and geographic validation in the \u003ccode\u003epublicar_aviso\u003c/code\u003e RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.\u0026nbsp;\u0026nbsp;"
}
],
"value": "Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T19:32:12.829Z",
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/advisories"
},
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/en/advisories"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Uncontrolled resource consumption via post_notice",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"assignerShortName": "Grayback",
"cveId": "CVE-2026-126784",
"datePublished": "2026-11-11T19:32:12.829Z",
"dateReserved": "2026-11-11T19:14:35.966Z",
"dateUpdated": "2026-11-11T19:32:12.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115998 (GCVE-0-2026-115998)
Vulnerability from cvelistv5 – Published: 2026-10-24 09:28 – Updated: 2026-11-02 14:05
VLAI
EPSS
VEX
Title
IDOR: User reads and modifies findings from other people's projects
Summary
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:04 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.grayback.es/advisories | patch |
| https://www.grayback.es/en/advisories | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CervantesSec | cervantes |
Affected:
alpha 0.3 , ≤ 1.3-beta
(custom)
Unaffected: v.1.4.0-beta cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115998",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:04:10.816409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:05:02.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cervantes",
"vendor": "CervantesSec",
"versions": [
{
"lessThanOrEqual": "1.3-beta",
"status": "affected",
"version": "alpha 0.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "v.1.4.0-beta"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3-beta",
"versionStartIncluding": "alpha_0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joan Arranz"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eIDOR i\u003cspan\u003en Cervantes version v1.3-beta could allow a\u003c/span\u003en authenticated attacker ca\u0026nbsp;access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca\u00a0access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T09:28:05.849Z",
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/advisories"
},
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/en/advisories"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IDOR: User reads and modifies findings from other people\u0027s projects",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"assignerShortName": "Grayback",
"cveId": "CVE-2026-115998",
"datePublished": "2026-10-24T09:28:05.849Z",
"dateReserved": "2026-10-24T09:23:13.297Z",
"dateUpdated": "2026-11-02T14:05:02.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115994 (GCVE-0-2026-115994)
Vulnerability from cvelistv5 – Published: 2026-10-24 09:04 – Updated: 2026-11-02 14:03
VLAI
EPSS
VEX
Title
BOLA Allows Cross-Project Target Tampering
Summary
BOLA Allows Cross-Project Target Tampering
in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:03 UTC
CWE
- CWE-639 - - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.grayback.es/advisories | patch |
| https://www.grayback.es/en/advisories | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CervantesSec | cervantes |
Affected:
alpha 0.3 , ≤ 1.3-beta
(custom)
Unaffected: v.1.4.0-beta cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115994",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:03:17.722632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:03:51.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cervantes",
"vendor": "CervantesSec",
"versions": [
{
"lessThanOrEqual": "1.3-beta",
"status": "affected",
"version": "alpha 0.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "v.1.4.0-beta"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3-beta",
"versionStartIncluding": "alpha_0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jaime Ram\u00edrez"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eBOLA Allows Cross-Project Target Tampering\u0026nbsp;\nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "BOLA Allows Cross-Project Target Tampering\u00a0\nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 - Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T09:04:02.750Z",
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/advisories"
},
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/en/advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
}
],
"value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "BOLA Allows Cross-Project Target Tampering",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"assignerShortName": "Grayback",
"cveId": "CVE-2026-115994",
"datePublished": "2026-10-24T09:04:02.750Z",
"dateReserved": "2026-10-24T08:56:03.942Z",
"dateUpdated": "2026-11-02T14:03:51.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115993 (GCVE-0-2026-115993)
Vulnerability from cvelistv5 – Published: 2026-10-24 08:32 – Updated: 2026-11-02 14:02
VLAI
EPSS
VEX
Title
Stored XSS in the “Notes” field of project checklists
Summary
Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:02 UTC
CWE
- CWE-79 - - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.grayback.es/advisories | patch |
| https://www.grayback.es/en/advisories | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CervantesSec | cervantes |
Affected:
alpha 0.3 , ≤ 1.3-beta
(custom)
Unaffected: v.1.4.0-beta cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115993",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:02:31.933756Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:02:56.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cervantes",
"vendor": "CervantesSec",
"versions": [
{
"lessThanOrEqual": "1.3-beta",
"status": "affected",
"version": "alpha 0.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "v.1.4.0-beta"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3-beta",
"versionStartIncluding": "alpha_0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Manuel Mart\u00ednez Casasola"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored XSS vulnerability in the \u201cNotes\u201d field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user\u0027s browser with elevated privileges"
}
],
"value": "Stored XSS vulnerability in the \u201cNotes\u201d field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user\u0027s browser with elevated privileges"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 - Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T08:32:46.940Z",
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/advisories"
},
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/en/advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
}
],
"value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Stored XSS in the \u201cNotes\u201d field of project checklists",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"assignerShortName": "Grayback",
"cveId": "CVE-2026-115993",
"datePublished": "2026-10-24T08:32:46.940Z",
"dateReserved": "2026-10-24T08:09:45.073Z",
"dateUpdated": "2026-11-02T14:02:56.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115975 (GCVE-0-2026-115975)
Vulnerability from cvelistv5 – Published: 2026-10-24 07:39 – Updated: 2026-11-02 14:00
VLAI
EPSS
VEX
Title
Broken access control in JiraController
Summary
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 13:58 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.grayback.es/advisories | patch |
| https://www.grayback.es/en/advisories | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CervantesSec | cervantes |
Affected:
alpha 0.3 , ≤ 1.3-beta
(custom)
Unaffected: v.1.4.0-beta cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:* |
Date Public
2026-10-24 07:03
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115975",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T13:58:29.261451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:00:09.921Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cervantes",
"vendor": "CervantesSec",
"versions": [
{
"lessThanOrEqual": "1.3-beta",
"status": "affected",
"version": "alpha 0.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "v.1.4.0-beta"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.3-beta",
"versionStartIncluding": "alpha_0.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Manuel Mart\u00ednez Casasola"
}
],
"datePublic": "2026-10-24T07:03:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects"
}
],
"value": "Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:22:02.018Z",
"orgId": "772f0079-75c2-41ca-913e-d9072716578b",
"shortName": "Grayback"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/advisories"
},
{
"tags": [
"patch"
],
"url": "https://www.grayback.es/en/advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
}
],
"value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Broken access control in JiraController",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
"assignerShortName": "Grayback",
"cveId": "CVE-2026-115975",
"datePublished": "2026-10-24T07:39:34.357Z",
"dateReserved": "2026-10-24T07:02:46.656Z",
"dateUpdated": "2026-11-02T14:00:09.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}