Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-112148 (GCVE-0-2026-112148)

Vulnerability from cvelistv5 – Published: 2026-10-20 06:31 – Updated: 2026-10-20 06:31

Summary

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-79

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://line.github.io/security-advisory-blog/CVE…
https://github.com/line/liff/security/advisories/…

Impacted products

1 product

Vendor	Product	Version
LY Corporation	LIFF SDK	Affected: 2.20.0 , < 2.31.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LIFF SDK",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "2.31.1",
              "status": "affected",
              "version": "2.20.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application\u0027s endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user\u0027s session."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T06:31:15.606Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://line.github.io/security-advisory-blog/CVE-2026-112148/"
        },
        {
          "url": "https://github.com/line/liff/security/advisories/GHSA-wppr-qmp4-w627"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-112148",
    "datePublished": "2026-10-20T06:31:15.606Z",
    "dateReserved": "2026-10-19T05:46:14.151Z",
    "dateUpdated": "2026-10-20T06:31:15.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11751 (GCVE-0-2026-11751)

Vulnerability from cvelistv5 – Published: 2026-08-19 01:19 – Updated: 2026-08-20 15:36

Summary

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 13:34 UTC

CWE

CWE-295

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://line.github.io/security-advisory-blog/CVE…
https://github.com/line/armeria/security/advisori…

Impacted products

1 product

Vendor	Product	Version
LY Corporation	Armeria	Unaffected: 1.41.0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11751",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:34:25.955134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:36:47.943Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Armeria",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.41.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T01:20:06.238Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://line.github.io/security-advisory-blog/CVE-2026-11751/"
        },
        {
          "url": "https://github.com/line/armeria/security/advisories/GHSA-6qfw-3mvj-m6v5"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-11751",
    "datePublished": "2026-08-19T01:19:34.960Z",
    "dateReserved": "2026-06-09T06:50:05.781Z",
    "dateUpdated": "2026-08-20T15:36:47.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-13133 (GCVE-0-2026-13133)

Vulnerability from cvelistv5 – Published: 2026-08-10 06:00 – Updated: 2026-08-10 18:02

Summary

A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-10 18:01 UTC

CWE

CWE-427
CWE-427 - Uncontrolled Search Path Element

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://line.github.io/security-advisory-blog/CVE…

Impacted products

1 product

Vendor	Product	Version
LY Corporation	LINE for Windows	Unaffected: 26.4.0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13133",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T18:01:46.381874Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-427",
                "description": "CWE-427 Uncontrolled Search Path Element",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T18:02:03.340Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "LINE for Windows",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer\u0027s directory to be loaded ahead of the legitimate System32 copy."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-427",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T06:00:12.020Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://line.github.io/security-advisory-blog/CVE-2026-13133/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-13133",
    "datePublished": "2026-08-10T06:00:12.020Z",
    "dateReserved": "2026-06-24T06:46:44.264Z",
    "dateUpdated": "2026-08-10T18:02:03.340Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16881 (GCVE-0-2026-16881)

Vulnerability from cvelistv5 – Published: 2026-08-04 05:05 – Updated: 2026-08-04 18:57

Summary

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile. A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 18:57 UTC

CWE

CWE-94

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://line.github.io/security-advisory-blog/CVE…

Impacted products

1 product

Vendor	Product	Version
LY Corporation	LINE client for Android	Unaffected: 26.7.2 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16881",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T18:57:00.623149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T18:57:11.045Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "LINE client for Android",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.7.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. \n\nThe profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. \n\nAs a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application\u0027s privileges when a victim views that profile. \n\nA server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T05:05:34.448Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://line.github.io/security-advisory-blog/CVE-2026-16881/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-16881",
    "datePublished": "2026-08-04T05:05:34.448Z",
    "dateReserved": "2026-07-24T04:50:38.815Z",
    "dateUpdated": "2026-08-04T18:57:11.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11748 (GCVE-0-2026-11748)

Vulnerability from cvelistv5 – Published: 2026-06-22 02:37 – Updated: 2026-06-22 16:12

Summary

A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 16:11 UTC

CWE

CWE-90
CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://github.com/line/centraldogma/security/adv…

Impacted products

1 product

Vendor	Product	Version
LY Corporation	Central Dogma	Unaffected: 0.84.0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11748",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T16:11:47.695670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-90",
                "description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T16:12:07.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Central Dogma",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.84.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-90",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T02:37:35.370Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-11748",
    "datePublished": "2026-06-22T02:37:35.370Z",
    "dateReserved": "2026-06-09T06:50:03.618Z",
    "dateUpdated": "2026-06-22T16:12:07.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11746 (GCVE-0-2026-11746)

Vulnerability from cvelistv5 – Published: 2026-06-22 02:35 – Updated: 2026-06-22 16:13

Summary

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 16:12 UTC

CWE

CWE-798
CWE-798 - Use of Hard-coded Credentials

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://github.com/line/centraldogma/security/adv…

Impacted products

1 product

Vendor	Product	Version
LY Corporation	Central Dogma	Unaffected: 0.84.0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11746",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T16:12:56.884349Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-798",
                "description": "CWE-798 Use of Hard-coded Credentials",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T16:13:00.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Central Dogma",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.84.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-798",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T02:35:51.201Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://github.com/line/centraldogma/security/advisories/GHSA-2j95-gqxf-v3vg"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-11746",
    "datePublished": "2026-06-22T02:35:51.201Z",
    "dateReserved": "2026-06-09T06:48:47.296Z",
    "dateUpdated": "2026-06-22T16:13:00.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11745 (GCVE-0-2026-11745)

Vulnerability from cvelistv5 – Published: 2026-06-22 02:33 – Updated: 2026-06-22 16:29

Summary

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 16:29 UTC

CWE

CWE-322
CWE-322 - Key Exchange without Entity Authentication

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://github.com/line/centraldogma/security/adv…

Impacted products

1 product

Vendor	Product	Version
LY Corporation	Central Dogma	Unaffected: 0.84.0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11745",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T16:29:39.280352Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-322",
                "description": "CWE-322 Key Exchange without Entity Authentication",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T16:29:43.057Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/line/centraldogma/security/advisories/GHSA-vjfw-cpmh-xwv3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Central Dogma",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.84.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-322",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-22T02:33:08.952Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://github.com/line/centraldogma/security/advisories/GHSA-vjfw-cpmh-xwv3"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-11745",
    "datePublished": "2026-06-22T02:33:08.952Z",
    "dateReserved": "2026-06-09T06:46:10.431Z",
    "dateUpdated": "2026-06-22T16:29:43.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11752 (GCVE-0-2026-11752)

Vulnerability from cvelistv5 – Published: 2026-06-19 04:29 – Updated: 2026-06-22 14:57

Summary

A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local files and environment variables on the xDS client host.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 14:57 UTC

CWE

CWE-73

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://github.com/line/armeria/security/advisori…

Impacted products

1 product

Vendor	Product	Version
LY Corporation	Armeria	Affected: 1.38.0 , < 1.40.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T14:57:29.287769Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T14:57:40.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Armeria",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "1.40.0",
              "status": "affected",
              "version": "1.38.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction, allowing a compromised or semi-trusted xDS control plane to read arbitrary local files and environment variables on the xDS client host."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-73",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T05:48:43.989Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://github.com/line/armeria/security/advisories/GHSA-hgw6-8c77-v4gq"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-11752",
    "datePublished": "2026-06-19T04:29:31.970Z",
    "dateReserved": "2026-06-09T06:50:06.220Z",
    "dateUpdated": "2026-06-22T14:57:40.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3861 (GCVE-0-2026-3861)

Vulnerability from cvelistv5 – Published: 2026-04-16 05:54 – Updated: 2026-05-22 05:00

Summary

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-16 12:16 UTC

CWE

CWE-400
CWE-451 - User Interface (UI) Misrepresentation of Critical Information

Assigner

LY-Corporation CNA under the jpcert root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://hackerone.com/reports/3422905

Impacted products

1 product

Vendor	Product	Version
LY Corporation	LINE client for iOS	Unaffected: 26.3.0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3861",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T12:16:15.191045Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-451",
                "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T12:31:11.953Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "LINE client for iOS",
          "vendor": "LY Corporation",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "cvssV4_0": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T05:00:53.312Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LY-Corporation"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3422905"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LY-Corporation",
    "cveId": "CVE-2026-3861",
    "datePublished": "2026-04-16T05:54:05.194Z",
    "dateReserved": "2026-03-10T05:02:39.735Z",
    "dateUpdated": "2026-05-22T05:00:53.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-41408 (GCVE-0-2025-41408)

Vulnerability from cvelistv5 – Published: 2025-09-05 05:25 – Updated: 2025-09-05 13:45

Summary

Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-05 13:38 UTC

CWE

CWE-939 - Improper authorization in handler for custom URL scheme

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 176 records in the last 180 days details

References

1 reference

URL	Tags
https://jvn.jp/en/jp/JVN35290164/

Impacted products

1 product

Vendor	Product	Version
LY Corporation	"Yahoo! Shopping" App for Android	Affected: versions prior to 14.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-05T13:38:02.982750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-05T13:45:13.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "\"Yahoo! Shopping\" App for Android",
          "vendor": "LY Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to 14.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authorization in handler for custom URL scheme issue in \"Yahoo! Shopping\" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper authorization in handler for custom URL scheme",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-05T05:25:15.422Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://jvn.jp/en/jp/JVN35290164/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-41408",
    "datePublished": "2025-09-05T05:25:15.422Z",
    "dateReserved": "2025-08-29T01:43:32.740Z",
    "dateUpdated": "2025-09-05T13:45:13.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-28895 (GCVE-0-2024-28895)

Vulnerability from cvelistv5 – Published: 2024-04-01 00:16 – Updated: 2024-11-06 20:45

Summary

'Yahoo! JAPAN' App for Android v2.3.1 to v3.161.1 and 'Yahoo! JAPAN' App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the WebView of 'Yahoo! JAPAN' App via other app installed on the user's device.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-01 20:03 UTC

CWE

Cross-site scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 176 records in the last 180 days details

References

1 reference

URL	Tags
https://jvn.jp/en/jp/JVN23528780/

Impacted products

2 products

Vendor	Product	Version
LY Corporation	'Yahoo! JAPAN' App for Android	Affected: v2.3.1 to v3.161.1
LY Corporation	'Yahoo! JAPAN' App for iOS	Affected: v3.2.2 to v4.109.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-28895",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-01T20:03:28.170849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T20:45:53.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:03:50.243Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN23528780/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "\u0027Yahoo! JAPAN\u0027 App for Android",
          "vendor": "LY Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "v2.3.1 to v3.161.1"
            }
          ]
        },
        {
          "product": "\u0027Yahoo! JAPAN\u0027 App for iOS",
          "vendor": "LY Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "v3.2.2 to v4.109.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\u0027Yahoo! JAPAN\u0027 App for Android v2.3.1 to v3.161.1 and \u0027Yahoo! JAPAN\u0027 App for iOS v3.2.2 to v4.109.0 contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the WebView of \u0027Yahoo! JAPAN\u0027 App via other app installed on the user\u0027s device."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-01T00:16:08.562Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://jvn.jp/en/jp/JVN23528780/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-28895",
    "datePublished": "2024-04-01T00:16:08.562Z",
    "dateReserved": "2024-03-13T00:41:43.890Z",
    "dateUpdated": "2024-11-06T20:45:53.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

11 vulnerabilities by LY Corporation

CVE-2026-112148 (GCVE-0-2026-112148)

CVE-2026-11751 (GCVE-0-2026-11751)

CVE-2026-13133 (GCVE-0-2026-13133)

CVE-2026-16881 (GCVE-0-2026-16881)

CVE-2026-11748 (GCVE-0-2026-11748)

CVE-2026-11746 (GCVE-0-2026-11746)

CVE-2026-11745 (GCVE-0-2026-11745)

CVE-2026-11752 (GCVE-0-2026-11752)

CVE-2026-3861 (GCVE-0-2026-3861)

CVE-2025-41408 (GCVE-0-2025-41408)

CVE-2024-28895 (GCVE-0-2024-28895)