Search

Find a vulnerability

Search criteria

    4 vulnerabilities

    CVE-2026-115998 (GCVE-0-2026-115998)

    Vulnerability from cvelistv5 – Published: 2026-10-24 09:28 – Updated: 2026-10-24 09:28
    VLAI
    Title
    IDOR: User reads and modifies findings from other people's projects
    Summary
    IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    Grayback CNA under the INCIBE root
    CNA scorecard – unranked: 4 records in the last 180 days, 10 needed details
    References
    Impacted products
    Vendor Product Version
    CervantesSec cervantes Affected: alpha 0.3 , ≤ 1.3-beta (custom)
    Unaffected: v.1.4.0-beta
        cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Joan Arranz
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cervantes",
          "vendor": "CervantesSec",
          "versions": [
            {
              "lessThanOrEqual": "1.3-beta",
              "status": "affected",
              "version": "alpha 0.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "v.1.4.0-beta"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3-beta",
                  "versionStartIncluding": "alpha_0.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joan Arranz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eIDOR i\u003cspan\u003en Cervantes version v1.3-beta could allow a\u003c/span\u003en authenticated attacker ca\u0026nbsp;access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.\u003c/p\u003e\u003c/div\u003e"
            }
          ],
          "value": "IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca\u00a0access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T09:28:05.849Z",
        "orgId": "772f0079-75c2-41ca-913e-d9072716578b",
        "shortName": "Grayback"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/advisories"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/en/advisories"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IDOR: User reads and modifies findings from other people\u0027s projects",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
    "assignerShortName": "Grayback",
    "cveId": "CVE-2026-115998",
    "datePublished": "2026-10-24T09:28:05.849Z",
    "dateReserved": "2026-10-24T09:23:13.297Z",
    "dateUpdated": "2026-10-24T09:28:05.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-115994 (GCVE-0-2026-115994)

    Vulnerability from cvelistv5 – Published: 2026-10-24 09:04 – Updated: 2026-10-24 09:04
    VLAI
    Title
    BOLA Allows Cross-Project Target Tampering
    Summary
    BOLA Allows Cross-Project Target Tampering  in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
    Severity
    5.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
    CWE
    • CWE-639 - - Authorization Bypass Through User-Controlled Key
    Assigner
    Grayback CNA under the INCIBE root
    CNA scorecard – unranked: 4 records in the last 180 days, 10 needed details
    References
    Impacted products
    Vendor Product Version
    CervantesSec cervantes Affected: alpha 0.3 , ≤ 1.3-beta (custom)
    Unaffected: v.1.4.0-beta
        cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Jaime Ramírez
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cervantes",
          "vendor": "CervantesSec",
          "versions": [
            {
              "lessThanOrEqual": "1.3-beta",
              "status": "affected",
              "version": "alpha 0.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "v.1.4.0-beta"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3-beta",
                  "versionStartIncluding": "alpha_0.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jaime Ram\u00edrez"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eBOLA Allows Cross-Project Target Tampering\u0026nbsp;\nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "BOLA Allows Cross-Project Target Tampering\u00a0\nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 - Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T09:04:02.750Z",
        "orgId": "772f0079-75c2-41ca-913e-d9072716578b",
        "shortName": "Grayback"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/advisories"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/en/advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
            }
          ],
          "value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "BOLA Allows Cross-Project Target Tampering",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
    "assignerShortName": "Grayback",
    "cveId": "CVE-2026-115994",
    "datePublished": "2026-10-24T09:04:02.750Z",
    "dateReserved": "2026-10-24T08:56:03.942Z",
    "dateUpdated": "2026-10-24T09:04:02.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-115993 (GCVE-0-2026-115993)

    Vulnerability from cvelistv5 – Published: 2026-10-24 08:32 – Updated: 2026-10-24 08:32
    VLAI
    Title
    Stored XSS in the “Notes” field of project checklists
    Summary
    Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
    CWE
    • CWE-79 - - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Grayback CNA under the INCIBE root
    CNA scorecard – unranked: 4 records in the last 180 days, 10 needed details
    References
    Impacted products
    Vendor Product Version
    CervantesSec cervantes Affected: alpha 0.3 , ≤ 1.3-beta (custom)
    Unaffected: v.1.4.0-beta
        cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Manuel Martínez Casasola
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cervantes",
          "vendor": "CervantesSec",
          "versions": [
            {
              "lessThanOrEqual": "1.3-beta",
              "status": "affected",
              "version": "alpha 0.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "v.1.4.0-beta"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3-beta",
                  "versionStartIncluding": "alpha_0.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Manuel Mart\u00ednez Casasola"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Stored XSS vulnerability in the \u201cNotes\u201d field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user\u0027s browser with elevated privileges"
            }
          ],
          "value": "Stored XSS vulnerability in the \u201cNotes\u201d field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user\u0027s browser with elevated privileges"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 - Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T08:32:46.940Z",
        "orgId": "772f0079-75c2-41ca-913e-d9072716578b",
        "shortName": "Grayback"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/advisories"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/en/advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
            }
          ],
          "value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS in the \u201cNotes\u201d field of project checklists",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
    "assignerShortName": "Grayback",
    "cveId": "CVE-2026-115993",
    "datePublished": "2026-10-24T08:32:46.940Z",
    "dateReserved": "2026-10-24T08:09:45.073Z",
    "dateUpdated": "2026-10-24T08:32:46.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-115975 (GCVE-0-2026-115975)

    Vulnerability from cvelistv5 – Published: 2026-10-24 07:39 – Updated: 2026-10-24 07:39
    VLAI
    Title
    Broken access control in JiraController
    Summary
    Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects
    Severity
    7.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
    CWE
    Assigner
    Grayback CNA under the INCIBE root
    CNA scorecard – unranked: 4 records in the last 180 days, 10 needed details
    References
    Impacted products
    Vendor Product Version
    CervantesSec cervantes Affected: alpha 0.3 , ≤ 1.3-beta (custom)
    Unaffected: v.1.4.0-beta
        cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-10-24 07:03
    Credits
    Manuel Martinez Casasola
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cervantes",
          "vendor": "CervantesSec",
          "versions": [
            {
              "lessThanOrEqual": "1.3-beta",
              "status": "affected",
              "version": "alpha 0.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "v.1.4.0-beta"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3-beta",
                  "versionStartIncluding": "alpha_0.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Manuel Martinez Casasola"
        }
      ],
      "datePublic": "2026-10-24T07:03:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects"
            }
          ],
          "value": "Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T07:39:34.357Z",
        "orgId": "772f0079-75c2-41ca-913e-d9072716578b",
        "shortName": "Grayback"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/advisories"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/en/advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
            }
          ],
          "value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Broken access control in JiraController",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
    "assignerShortName": "Grayback",
    "cveId": "CVE-2026-115975",
    "datePublished": "2026-10-24T07:39:34.357Z",
    "dateReserved": "2026-10-24T07:02:46.656Z",
    "dateUpdated": "2026-10-24T07:39:34.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}