Search
Find a vulnerability
Search criteria
404144 vulnerabilities
No criteria set — showing every indexed entry of the selected sources, newest first by published date.
CVE-2026-113392 (GCVE-0-2026-113392)
Vulnerability from cvelistv5 – Published: 2026-10-20 13:00 – Updated: 2026-10-20 13:00 Unsupported When Assigned
VLAI
EPSS
VEX
Title
DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal
Summary
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422668 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422668/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113392 | third-party-advisory |
| https://vuldb.com/submit/992245 | third-party-advisory |
| https://github.com/yikesoftware/DrayTek_Vigor2960… | exploit |
| https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5… | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Apmupload"
],
"product": "Vigor2960",
"vendor": "DrayTek",
"versions": [
{
"status": "affected",
"version": "1.5.1.6 Revision 8218"
},
{
"status": "unaffected",
"version": "1.5.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "eqqie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:00:16.852Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422668 | DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422668"
},
{
"name": "VDB-422668 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422668/cti"
},
{
"name": "CVE-2026-113392 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113392"
},
{
"name": "Submit #992245 | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) uthenticated apmupload Path Traversal File Clobber",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992245"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0009-authenticated-apmupload-path-traversal-clobber"
},
{
"tags": [
"patch"
],
"url": "https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T07:55:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113392",
"datePublished": "2026-10-20T13:00:16.852Z",
"dateReserved": "2026-10-20T05:50:18.933Z",
"dateUpdated": "2026-10-20T13:00:16.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105941 (GCVE-0-2026-105941)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:59 – Updated: 2026-10-20 12:59
VLAI
EPSS
VEX
Title
Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
Summary
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
Severity
8.1 (High)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-105941 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2510876 | issue-trackingx_refsource_REDHAT |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
Date Public
2026-10-20 11:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "kroxylicious-kms-provider-azure-key-vault-kms",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-10-20T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy\u0027s Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:59:00.134Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-105941"
},
{
"name": "RHBZ#2510876",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510876"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-04T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-20T11:00:00.000Z",
"value": "Made public."
}
],
"title": "Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname",
"workarounds": [
{
"lang": "en",
"value": "1. Bind all topics to KEKs \u2014 remove PASSTHROUGH_UNENCRYPTED as unresolvedKeyPolicy. Explicitly configure kekSelector to match every topic.\n2. Restrict outbound network access \u2014 use Kubernetes NetworkPolicy to limit proxy pod egress to only legitimate Azure Key Vault endpoints on port 443.\n3. Monitor KMS call patterns \u2014 alert on unwrap requests targeting unexpected vault hostnames."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-105941",
"datePublished": "2026-10-20T12:59:00.134Z",
"dateReserved": "2026-10-06T07:03:52.238Z",
"dateUpdated": "2026-10-20T12:59:00.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113401 (GCVE-0-2026-113401)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:58 – Updated: 2026-10-20 12:58
VLAI
EPSS
VEX
Title
Denial-of-service in the PDF Viewer component
Summary
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
Severity
No CVSS data available.
Assigner
References
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ahmed Hesham"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1."
}
],
"value": "Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:58:16.245Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073714"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
}
],
"title": "Denial-of-service in the PDF Viewer component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113401",
"datePublished": "2026-10-20T12:58:16.245Z",
"dateReserved": "2026-10-20T06:00:59.236Z",
"dateUpdated": "2026-10-20T12:58:16.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113400 (GCVE-0-2026-113400)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:58 – Updated: 2026-10-20 12:58
VLAI
EPSS
VEX
Title
Uninitialized memory in the Audio/Video: cubeb component
Summary
Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
Severity
No CVSS data available.
Assigner
References
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1."
}
],
"value": "Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:58:15.589Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2061768"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
}
],
"title": "Uninitialized memory in the Audio/Video: cubeb component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113400",
"datePublished": "2026-10-20T12:58:15.589Z",
"dateReserved": "2026-10-20T06:00:56.437Z",
"dateUpdated": "2026-10-20T12:58:15.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113399 (GCVE-0-2026-113399)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:58 – Updated: 2026-10-20 12:58
VLAI
EPSS
VEX
Title
Incorrect boundary conditions in the SVG component
Summary
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1.
Severity
No CVSS data available.
Assigner
References
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1."
}
],
"value": "Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:58:14.968Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2079938"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
}
],
"title": "Incorrect boundary conditions in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113399",
"datePublished": "2026-10-20T12:58:14.968Z",
"dateReserved": "2026-10-20T06:00:54.207Z",
"dateUpdated": "2026-10-20T12:58:14.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113470 (GCVE-0-2026-113470)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:58 – Updated: 2026-10-20 12:58
VLAI
EPSS
VEX
Title
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
Summary
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1.
Severity
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.43.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.5.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "158.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Wayne"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user\u0027s network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1."
}
],
"value": "Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user\u0027s network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:58:14.250Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083382"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-111/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-112/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-113/"
}
],
"title": "Cryptographic issue in the Security Block-lists, Allow-lists, and other State component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-113470",
"datePublished": "2026-10-20T12:58:14.250Z",
"dateReserved": "2026-10-20T08:27:10.793Z",
"dateUpdated": "2026-10-20T12:58:14.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113391 (GCVE-0-2026-113391)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:45 – Updated: 2026-10-20 12:45 Unsupported When Assigned
VLAI
EPSS
VEX
Title
DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
Summary
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Severity
9.9 (Critical)
9.9 (Critical)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422667 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422667/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113391 | third-party-advisory |
| https://vuldb.com/submit/992244 | third-party-advisory |
| https://github.com/yikesoftware/DrayTek_Vigor2960… | exploit |
| https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5… | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Upload Endpoint"
],
"product": "Vigor2960",
"vendor": "DrayTek",
"versions": [
{
"status": "affected",
"version": "1.5.1.6 Revision 8218"
},
{
"status": "unaffected",
"version": "1.5.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "eqqie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:45:19.982Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422667 | DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422667"
},
{
"name": "VDB-422667 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422667/cti"
},
{
"name": "CVE-2026-113391 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113391"
},
{
"name": "Submit #992244 | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Upload Filename Command Injection Across Multiple Authenticated",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992244"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0008-authenticated-upload-filename-command-injection"
},
{
"tags": [
"patch"
],
"url": "https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T07:55:52.000Z",
"value": "VulDB entry last update"
}
],
"title": "DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113391",
"datePublished": "2026-10-20T12:45:19.982Z",
"dateReserved": "2026-10-20T05:50:15.239Z",
"dateUpdated": "2026-10-20T12:45:19.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113620 (GCVE-0-2026-113620)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:34 – Updated: 2026-10-20 12:34
VLAI
EPSS
VEX
Title
Eclipse ioFog operator WebSocket accepts an unverified JWT
Summary
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.
Severity
9.8 (Critical)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse ioFog |
Affected:
3.8.0 , ≤ 3.9.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eclipse ioFog",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "3.9.1",
"status": "affected",
"version": "3.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected.\u003c/p\u003e"
}
],
"value": "In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role, with no account and no RoleBinding. The attacker can open an exec or log session for a microservice or fog whose UUID they already know. HTTP routes are not affected: they verify the token before RBAC. Agent WebSockets verify the fog token and are not affected."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:34:08.238Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1270"
},
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1269"
},
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1267"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/468"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Eclipse ioFog operator WebSocket accepts an unverified JWT",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-113620",
"datePublished": "2026-10-20T12:34:08.238Z",
"dateReserved": "2026-10-20T12:18:55.770Z",
"dateUpdated": "2026-10-20T12:34:08.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113390 (GCVE-0-2026-113390)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:30 – Updated: 2026-10-20 12:30 Unsupported When Assigned
VLAI
EPSS
VEX
Title
DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
Summary
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Severity
9.9 (Critical)
9.9 (Critical)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422666 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422666/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113390 | third-party-advisory |
| https://vuldb.com/submit/992224 | third-party-advisory |
| https://github.com/yikesoftware/DrayTek_Vigor2960… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"CGI Interface"
],
"product": "Vigor2960",
"vendor": "DrayTek",
"versions": [
{
"status": "affected",
"version": "1.5.1.6 Revision 8218"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "eqqie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:30:17.628Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422666 | DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422666"
},
{
"name": "VDB-422666 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422666/cti"
},
{
"name": "CVE-2026-113390 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113390"
},
{
"name": "Submit #992224 | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Authenticated jsonstatus File Operations and Multi-Sink Command",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992224"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0007-authenticated-jsonstatus-usefile-file-clobber"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T07:55:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113390",
"datePublished": "2026-10-20T12:30:17.628Z",
"dateReserved": "2026-10-20T05:50:11.398Z",
"dateUpdated": "2026-10-20T12:30:17.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113619 (GCVE-0-2026-113619)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:23 – Updated: 2026-10-20 12:23
VLAI
EPSS
VEX
Title
Eclipse ioFog renders request templates before authentication
Summary
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.
Severity
7.5 (High)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse ioFog |
Affected:
3.8.0 , ≤ 3.9.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eclipse ioFog",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "3.9.1",
"status": "affected",
"version": "3.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process.\u003c/p\u003e"
}
],
"value": "In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies only to user login routes. A small JSON body can stall or abort the Controller process. The anonymous caller does not receive the rendered result; the impact is availability of the control plane, including the agent API and in-process WebSocket relays on that process."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:23:27.962Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1268"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/469"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Eclipse ioFog renders request templates before authentication",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-113619",
"datePublished": "2026-10-20T12:23:27.962Z",
"dateReserved": "2026-10-20T12:18:18.039Z",
"dateUpdated": "2026-10-20T12:23:27.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34485 (GCVE-0-2026-34485)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:13 – Updated: 2026-10-20 12:13
VLAI
EPSS
VEX
Title
A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)
Summary
Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nokia | Nokia 1830 Global Express (GX) |
Affected:
G42, GX G31, GX G32, GX G34 releases prior to GX r9.0
Unaffected: r9.0 and later releases |
{
"containers": {
"cna": {
"affected": [
{
"product": "Nokia 1830 Global Express (GX)",
"vendor": "Nokia",
"versions": [
{
"status": "affected",
"version": "G42, GX G31, GX G32, GX G34 releases prior to GX r9.0"
},
{
"status": "unaffected",
"version": "r9.0 and later releases"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is not the result of misconfiguration."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:13:17.792Z",
"orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
"shortName": "Nokia"
},
"references": [
{
"name": "Nokia Product Security Advisory",
"url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-34485/"
}
],
"title": "A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)",
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
"assignerShortName": "Nokia",
"cveId": "CVE-2026-34485",
"datePublished": "2026-10-20T12:13:17.792Z",
"dateReserved": "2026-03-30T07:44:16.111Z",
"dateUpdated": "2026-10-20T12:13:17.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34484 (GCVE-0-2026-34484)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:10 – Updated: 2026-10-20 12:10
VLAI
EPSS
VEX
Title
A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX)
Summary
Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this vulnerability to bypass local security restrictions and gain root access on the device.
Severity
No CVSS data available.
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nokia | Nokia 1830 Global Express (GX) |
Affected:
G42, GX G31, GX G32, GX G34 releases prior to GX r9.0.
Unaffected: r9.0 and later releases |
{
"containers": {
"cna": {
"affected": [
{
"product": "Nokia 1830 Global Express (GX)",
"vendor": "Nokia",
"versions": [
{
"status": "affected",
"version": "G42, GX G31, GX G32, GX G34 releases prior to GX r9.0."
},
{
"status": "unaffected",
"version": "r9.0 and later releases"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this vulnerability to bypass local security restrictions and gain root access on the device."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:10:44.965Z",
"orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
"shortName": "Nokia"
},
"references": [
{
"name": "Nokia Product Security Advisory",
"url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-34484/"
}
],
"title": "A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX)",
"x_generator": {
"engine": "cveClient/1.0.15"
}
}
},
"cveMetadata": {
"assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0",
"assignerShortName": "Nokia",
"cveId": "CVE-2026-34484",
"datePublished": "2026-10-20T12:10:44.965Z",
"dateReserved": "2026-03-30T07:44:16.110Z",
"dateUpdated": "2026-10-20T12:10:44.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113389 (GCVE-0-2026-113389)
Vulnerability from cvelistv5 – Published: 2026-10-20 12:00 – Updated: 2026-10-20 12:00 Unsupported When Assigned
VLAI
EPSS
VEX
Title
DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
Summary
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Severity
9.9 (Critical)
9.9 (Critical)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422665 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422665/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113389 | third-party-advisory |
| https://vuldb.com/submit/992223 | third-party-advisory |
| https://github.com/yikesoftware/DrayTek_Vigor2960… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"CGI Process"
],
"product": "Vigor2960",
"vendor": "DrayTek",
"versions": [
{
"status": "affected",
"version": "1.5.1.6 Revision 8218"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "eqqie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:00:14.778Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422665 | DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422665"
},
{
"name": "VDB-422665 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422665/cti"
},
{
"name": "CVE-2026-113389 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113389"
},
{
"name": "Submit #992223 | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Authenticated set_table JSONData Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/992223"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T07:55:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113389",
"datePublished": "2026-10-20T12:00:14.778Z",
"dateReserved": "2026-10-20T05:50:07.473Z",
"dateUpdated": "2026-10-20T12:00:14.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113388 (GCVE-0-2026-113388)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:45 – Updated: 2026-10-20 11:45 X_Open Source
VLAI
EPSS
VEX
Title
opensource-socialnetwork Cache Settings dynamic.php input code injection
Summary
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422662 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422662/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113388 | third-party-advisory |
| https://vuldb.com/submit/1009749 | third-party-advisory |
| https://gist.github.com/qianqiusujiu/c0452f09e91d… | exploit |
| https://github.com/opensource-socialnetwork/opens… | patch |
| https://github.com/opensource-socialnetwork/opens… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | opensource-socialnetwork |
Affected:
9.0
Affected: 9.1 Affected: 9.2 Affected: 9.3 Affected: 9.4 Affected: 9.5 Affected: 9.6 Affected: 9.7 Affected: 9.8 Affected: 9.9 Affected: 9.10 Affected: 9.11 Affected: 10.0 Affected: 10.1 cpe:2.3:a:opensource-socialnetwork:opensource-socialnetwork:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:opensource-socialnetwork:opensource-socialnetwork:*:*:*:*:*:*:*:*"
],
"modules": [
"Cache Settings"
],
"product": "opensource-socialnetwork",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "9.1"
},
{
"status": "affected",
"version": "9.2"
},
{
"status": "affected",
"version": "9.3"
},
{
"status": "affected",
"version": "9.4"
},
{
"status": "affected",
"version": "9.5"
},
{
"status": "affected",
"version": "9.6"
},
{
"status": "affected",
"version": "9.7"
},
{
"status": "affected",
"version": "9.8"
},
{
"status": "affected",
"version": "9.9"
},
{
"status": "affected",
"version": "9.10"
},
{
"status": "affected",
"version": "9.11"
},
{
"status": "affected",
"version": "10.0"
},
{
"status": "affected",
"version": "10.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qianqiu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: \"While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:45:15.583Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422662 | opensource-socialnetwork Cache Settings dynamic.php input code injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422662"
},
{
"name": "VDB-422662 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422662/cti"
},
{
"name": "CVE-2026-113388 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113388"
},
{
"name": "Submit #1009749 | opensource-socialnetwork Open Source Social Network (OSSN) v9.1.0.0 (master branch, commit 9983ea4) CWE-94 Remote Code Execution (RCE)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009749"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/qianqiusujiu/c0452f09e91de23f002a384038325104"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/40945057cb451f0f35153110bc7e889c094400e1"
},
{
"tags": [
"product"
],
"url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T07:34:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "opensource-socialnetwork Cache Settings dynamic.php input code injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113388",
"datePublished": "2026-10-20T11:45:15.583Z",
"dateReserved": "2026-10-20T05:29:08.714Z",
"dateUpdated": "2026-10-20T11:45:15.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113583 (GCVE-0-2026-113583)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:35 – Updated: 2026-10-20 11:35 X_Open Source
VLAI
EPSS
VEX
Title
Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
Summary
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/cypht-org/cypht/pull/2118/chan… | issue-tracking |
| https://github.com/cypht-org/cypht/releases#relea… | patch |
| https://www.vulncheck.com/advisories/cypht-throug… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/cypht-org/cypht",
"product": "cypht",
"repo": "https://github.com/cypht-org/cypht",
"vendor": "cypht-org",
"versions": [
{
"lessThan": "2.13.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cypht:cypht:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.13.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Anonymous"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email\u0027s external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim\u0027s authenticated session to read mailboxes, send email, or change settings."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:35:29.543Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/cypht-org/cypht/pull/2118/changes/75d2fb83d228be2aaa37036a11eea68d82122d85"
},
{
"name": "Vendor Patch",
"tags": [
"patch"
],
"url": "https://github.com/cypht-org/cypht/releases#release-v2.13.0"
},
{
"name": "VulnCheck Advisory: Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cypht-through-stored-dom-xss-via-externalresources-js"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113583",
"datePublished": "2026-10-20T11:35:29.543Z",
"dateReserved": "2026-10-20T11:32:02.400Z",
"dateUpdated": "2026-10-20T11:35:29.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105949 (GCVE-0-2026-105949)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:30 – Updated: 2026-10-20 11:30
VLAI
EPSS
VEX
Title
Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
Summary
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.
Severity
8.8 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-105949 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2510878 | issue-trackingx_refsource_REDHAT |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
|
Affected:
2.0.82 , < 3.1.0
(semver)
|
|||
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
|
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
Date Public
2026-10-20 11:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/cruise-control-for-kafka/cruise-control",
"defaultStatus": "unaffected",
"packageName": "Cruise Control for Apache Kafka",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "2.0.82",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "cruise-control",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "cruise-control",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-10-20T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cruise Control\u0027s Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator\u0027s NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:30:29.296Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-105949"
},
{
"name": "RHBZ#2510878",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510878"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-04T03:32:18.261Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-20T11:00:00.000Z",
"value": "Made public."
}
],
"title": "Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints",
"workarounds": [
{
"lang": "en",
"value": "1. Verify Strimzi NetworkPolicy exists restricting CC :9090 to operator pods\n2. Do not expose CC :9090 via Ingress or Route \u2014 must not be externally accessible\n3. Confirm TLS is enabled on the CC HTTP endpoint (Strimzi default)\n4. For standalone CC: deploy path-normalizing reverse proxy and restrict :9090 via firewall"
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-287: Improper Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-105949",
"datePublished": "2026-10-20T11:30:29.296Z",
"dateReserved": "2026-10-06T07:57:58.570Z",
"dateUpdated": "2026-10-20T11:30:29.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105312 (GCVE-0-2026-105312)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:30 – Updated: 2026-10-20 11:30
VLAI
EPSS
VEX
Title
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
Summary
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.
Severity
9.9 (Critical)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-105312 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2510863 | issue-trackingx_refsource_REDHAT |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | StreamsHub Console for Apache Kafka® |
Affected:
0.2.0 , < 0.12.10
(semver)
Affected: 0.13.0 , < 0.14.2 (semver) |
|
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
|
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
Date Public
2026-10-20 11:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/streamshub/console",
"defaultStatus": "unaffected",
"packageName": "console",
"product": "StreamsHub Console for Apache Kafka\u00ae",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "0.12.10",
"status": "affected",
"version": "0.2.0",
"versionType": "semver"
},
{
"lessThan": "0.14.2",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "console-operator",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "console-operator",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-10-20T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker\u0027s code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:30:20.850Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-105312"
},
{
"name": "RHBZ#2510863",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510863"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-04T01:31:04.894Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-20T11:00:00.000Z",
"value": "Made public."
}
],
"title": "Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation",
"workarounds": [
{
"lang": "en",
"value": "1. Restrict Console CR RBAC \u2014 remove create/update/patch verbs on consoles.console.streamshub.github.com from tenant-level Roles. Only cluster administrators should manage Console CRs.\n2. Deploy admission webhook \u2014 use OPA/Gatekeeper or Kyverno policy to validate spec.containers.api.spec.image against a trusted registry allowlist.\n3. Apply network policies \u2014 restrict console-api pod egress to only required endpoints.\n4. Single-tenant deployment \u2014 deploy the Console operator where only trusted administrators manage Console CRs."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-269: Improper Privilege Management"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-105312",
"datePublished": "2026-10-20T11:30:20.850Z",
"dateReserved": "2026-10-05T07:03:59.012Z",
"dateUpdated": "2026-10-20T11:30:20.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105311 (GCVE-0-2026-105311)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:30 – Updated: 2026-10-20 11:30
VLAI
EPSS
VEX
Title
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
Summary
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.
Severity
7.7 (High)
CWE
- CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-105311 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2510875 | issue-trackingx_refsource_REDHAT |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | StreamsHub Console for Apache Kafka® |
Affected:
0.2.0 , < 0.12.10
(semver)
Affected: 0.13.0 , < 0.14.2 (semver) |
|
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
|
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
Date Public
2026-10-20 11:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/streamshub/console",
"defaultStatus": "unaffected",
"packageName": "console",
"product": "StreamsHub Console for Apache Kafka\u00ae",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "0.12.10",
"status": "affected",
"version": "0.2.0",
"versionType": "semver"
},
{
"lessThan": "0.14.2",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "console-operator",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "console-operator",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-10-20T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker\u0027s namespace. No same-namespace check or allowlist exists anywhere in the code path."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:30:09.568Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-105311"
},
{
"name": "RHBZ#2510875",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510875"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-04T03:10:18.848Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-20T11:00:00.000Z",
"value": "Made public."
}
],
"title": "Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy",
"workarounds": [
{
"lang": "en",
"value": "1. Restrict Console CR RBAC \u2014 remove create/update verbs on consoles.console.streamshub.github.com from tenant-facing roles. Only trusted cluster administrators should manage Console CRs.\n2. Audit existing Console CRs \u2014 review all Console CRs for kafkaUser.namespace fields pointing outside the CR\u0027s own namespace.\n3. Network policy (defense-in-depth) \u2014 apply NetworkPolicy to restrict operator pod egress."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-105311",
"datePublished": "2026-10-20T11:30:09.568Z",
"dateReserved": "2026-10-05T07:03:59.012Z",
"dateUpdated": "2026-10-20T11:30:09.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18205 (GCVE-0-2026-18205)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:24 – Updated: 2026-10-20 11:24
VLAI
EPSS
VEX
Title
XSS in Ticimax Informatics' Ticimax E-Commerce Platform
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS.
This issue affects Ticimax E-Commerce Platform: through 2026-10-20.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ticimax Informatics Technologies Inc. | Ticimax E-Commerce Platform |
Affected:
0 , ≤ 2026-10-20
(date)
|
Date Public
2026-10-20 11:17
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Ticimax E-Commerce Platform",
"vendor": "Ticimax Informatics Technologies Inc.",
"versions": [
{
"lessThanOrEqual": "2026-10-20",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ali Murat Tava"
},
{
"lang": "en",
"type": "sponsor",
"value": "Borusan Otomotiv"
}
],
"datePublic": "2026-10-20T11:17:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS.\u003cp\u003eThis issue affects Ticimax E-Commerce Platform: through 2026-10-20.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS.\n\nThis issue affects Ticimax E-Commerce Platform: through 2026-10-20."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:24:49.050Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1364"
}
],
"source": {
"advisory": "TR-26-1364",
"defect": [
"TR-26-1364"
],
"discovery": "UNKNOWN"
},
"title": "XSS in Ticimax Informatics\u0027 Ticimax E-Commerce Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-18205",
"datePublished": "2026-10-20T11:24:49.050Z",
"dateReserved": "2026-07-29T07:53:30.790Z",
"dateUpdated": "2026-10-20T11:24:49.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113385 (GCVE-0-2026-113385)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:15 – Updated: 2026-10-20 11:15
VLAI
EPSS
VEX
Title
LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
Summary
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
CWE
- CWE-926 - Improper Export of Android Application Components
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422658 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422658/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113385 | third-party-advisory |
| https://vuldb.com/submit/1003932 | third-party-advisory |
| https://docs.google.com/document/d/1_CRu5x_2OFJc-… | exploit |
| https://play.google.com/store/apps/details?id=com… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| LeeDrOiD Labs | Shortcutter 2 App |
Affected:
9.0.48
Unaffected: 9.0.90 cpe:2.3:a:leedroid_labs:shortcutter_2_app:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leedroid_labs:shortcutter_2_app:*:*:*:*:*:*:*:*"
],
"product": "Shortcutter 2 App",
"vendor": "LeeDrOiD Labs",
"versions": [
{
"status": "affected",
"version": "9.0.48"
},
{
"status": "unaffected",
"version": "9.0.90"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Actuator (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-926",
"description": "Improper Export of Android Application Components",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:15:14.699Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422658 | LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422658"
},
{
"name": "VDB-422658 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422658/cti"
},
{
"name": "CVE-2026-113385 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113385"
},
{
"name": "Submit #1003932 | LeeDrOiD Labs Shortcutter - Quick Settings \u0026 Shortcuts (com.leedroid.shortcutter) 7.8.0 (780) Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1003932"
},
{
"tags": [
"exploit"
],
"url": "https://docs.google.com/document/d/1_CRu5x_2OFJc-iZCP_GI0L88rEUOlgs3TCv9jM5L-b4/edit?usp=sharing"
},
{
"tags": [
"patch"
],
"url": "https://play.google.com/store/apps/details?id=com.leedroid.shortcutter"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T06:51:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113385",
"datePublished": "2026-10-20T11:15:14.699Z",
"dateReserved": "2026-10-20T04:46:23.665Z",
"dateUpdated": "2026-10-20T11:15:14.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113496 (GCVE-0-2026-113496)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:09 – Updated: 2026-10-20 12:45
VLAI
EPSS
VEX
Title
Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
Summary
A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 12:44 UTC
CWE
- CWE-214 - Invocation of Process Using Visible Sensitive Information
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-113496 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2556058 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
Date Public
2026-10-20 09:17
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T12:44:50.167799Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T12:45:08.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "cockpit-machines",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "cockpit-machines",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Andrey Vasilevsky for reporting this issue."
}
],
"datePublic": "2026-10-20T09:17:33.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine\u0027s graphical console."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-214",
"description": "Invocation of Process Using Visible Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:09:12.095Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-113496"
},
{
"name": "RHBZ#2556058",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556058"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-15T04:46:53.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-20T09:17:33.000Z",
"value": "Made public."
}
],
"title": "Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-214: Invocation of Process Using Visible Sensitive Information"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-113496",
"datePublished": "2026-10-20T11:09:12.095Z",
"dateReserved": "2026-10-20T09:12:57.667Z",
"dateUpdated": "2026-10-20T12:45:08.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113495 (GCVE-0-2026-113495)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:09 – Updated: 2026-10-20 11:09
VLAI
EPSS
VEX
Title
Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
Summary
A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.
Severity
5 (Medium)
CWE
- CWE-214 - Invocation of Process Using Visible Sensitive Information
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-113495 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2556057 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
Date Public
2026-10-20 09:17
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "cockpit-machines",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "cockpit-machines",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Andrey Vasilevsky for reporting this issue."
}
],
"datePublic": "2026-10-20T09:17:33.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token\u0027s validity period."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-214",
"description": "Invocation of Process Using Visible Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:09:07.286Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-113495"
},
{
"name": "RHBZ#2556057",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556057"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-15T04:46:53.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-20T09:17:33.000Z",
"value": "Made public."
}
],
"title": "Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-214: Invocation of Process Using Visible Sensitive Information"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-113495",
"datePublished": "2026-10-20T11:09:07.286Z",
"dateReserved": "2026-10-20T09:12:57.667Z",
"dateUpdated": "2026-10-20T11:09:07.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14933 (GCVE-0-2026-14933)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:08 – Updated: 2026-10-20 11:08
VLAI
EPSS
VEX
Title
Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
Summary
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.
The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.
Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Unaffected:
8.35.2-hotfix.0 , < 8.35.2
(semver)
Unaffected: 8.37.2-hotfix.2 , < 8.37.2 (semver) Unaffected: 8.38.2-hotfix.0 , < 8.38.2 (semver) Affected: 7.0 , ≤ 7.57.7 (semver) Affected: 8.0 , ≤ 8.39.2 (semver) Unaffected: 8.39.3 |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThan": "8.35.2",
"status": "unaffected",
"version": "8.35.2-hotfix.0",
"versionType": "semver"
},
{
"lessThan": "8.37.2",
"status": "unaffected",
"version": "8.37.2-hotfix.2",
"versionType": "semver"
},
{
"lessThan": "8.38.2",
"status": "unaffected",
"version": "8.38.2-hotfix.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.57.7",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.39.2",
"status": "affected",
"version": "8.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.39.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\u003c/p\u003e\u003cp\u003eThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\u003c/p\u003e\u003cp\u003eExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected.\u003c/p\u003e"
}
],
"value": "Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker\u0027s co-browsing session, via content of the co-browsed page that the agent\u0027s browser renders as HTML.\n\n\n\nThe JavaScript runs in the context and under the identity of the agent\u0027s session in the Agent Desk or the Single Conversation Desk.\n\n\n\nExploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn\u0027t affected."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:08:43.830Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-004"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\u003c/p\u003e\u003cp\u003eUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\u003c/p\u003e\u003cp\u003eFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin.\u003c/p\u003e"
}
],
"value": "Upgrade to Unblu Spark 8.39.3 or later, or 7.57.9 or later. The fix is also available in 8.35.2-hotfix.0, 8.37.2-hotfix.2, 8.38.2-hotfix.0 and later hotfixes of these release lines.\n\n\n\nUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\n\n\n\nFor a workaround for on-premises deployments that can\u0027t be upgraded immediately, see the security bulletin."
}
],
"source": {
"advisory": "UBL-2026-004",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Cross-Site Scripting in Embedded Co-Browsing",
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-14933",
"datePublished": "2026-10-20T11:08:43.830Z",
"dateReserved": "2026-07-07T10:56:24.163Z",
"dateUpdated": "2026-10-20T11:08:43.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9589 (GCVE-0-2026-9589)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:01 – Updated: 2026-10-20 11:01
VLAI
EPSS
VEX
Title
Unblu Spark Authorization Bypass in Configuration Cascade Operations
Summary
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.
The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.
Exploitation requires an authenticated session but no user interaction.
Severity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://docs.unblu.com/latest/security-bulletins/… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unblu inc. | Unblu Spark |
Affected:
7.0 , < 8.37.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"On-premises",
"Cloud"
],
"product": "Unblu Spark",
"vendor": "Unblu inc.",
"versions": [
{
"lessThan": "8.37.0",
"status": "affected",
"version": "7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kenan Karalioglu (chef_shell) via YesWeHack"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren\u0027t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers\u0027 accounts, via configuration read and write operations that target those entities.\u003c/p\u003e\u003cp\u003eThe Collaboration Server doesn\u0027t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren\u0027t allowed to edit, in any scope.\u003c/p\u003e\u003cp\u003eExploitation requires an authenticated session but no user interaction.\u003c/p\u003e"
}
],
"value": "Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren\u0027t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers\u0027 accounts, via configuration read and write operations that target those entities.\n\n\n\nThe Collaboration Server doesn\u0027t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren\u0027t allowed to edit, in any scope.\n\n\n\nExploitation requires an authenticated session but no user interaction."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Unblu Cloud"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "On-premises deployment"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:01:14.409Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"name": "Unblu Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://docs.unblu.com/latest/security-bulletins/#UBL-2026-002"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Unblu Spark 8.37.2 or later. There is no fix for Unblu Spark 7.x.\u003c/p\u003e\u003cp\u003eUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\u003c/p\u003e\u003cp\u003eThere is no workaround for on-premises deployments.\u003c/p\u003e"
}
],
"value": "Upgrade to Unblu Spark 8.37.2 or later. There is no fix for Unblu Spark 7.x.\n\n\n\nUnblu Cloud customers needn\u0027t take any action. The fix is already deployed in Unblu Cloud.\n\n\n\nThere is no workaround for on-premises deployments."
}
],
"source": {
"advisory": "UBL-2026-002",
"discovery": "EXTERNAL"
},
"title": "Unblu Spark Authorization Bypass in Configuration Cascade Operations",
"x_generator": {
"engine": "manual"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-9589",
"datePublished": "2026-10-20T11:01:14.409Z",
"dateReserved": "2026-05-26T13:09:34.301Z",
"dateUpdated": "2026-10-20T11:01:14.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113384 (GCVE-0-2026-113384)
Vulnerability from cvelistv5 – Published: 2026-10-20 11:00 – Updated: 2026-10-20 11:00
VLAI
EPSS
VEX
Title
Optimal IdM OptimalCloud social redirect
Summary
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-601 - Open Redirect
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422657 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422657/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113384 | third-party-advisory |
| https://vuldb.com/submit/991714 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Optimal IdM | OptimalCloud |
Affected:
5.0
cpe:2.3:a:optimal_idm:optimalcloud:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:optimal_idm:optimalcloud:*:*:*:*:*:*:*:*"
],
"product": "OptimalCloud",
"vendor": "Optimal IdM",
"versions": [
{
"status": "affected",
"version": "5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexandre Rodrigo (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T11:00:12.874Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422657 | Optimal IdM OptimalCloud social redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422657"
},
{
"name": "VDB-422657 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422657/cti"
},
{
"name": "CVE-2026-113384 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113384"
},
{
"name": "Submit #991714 | Optimal IdM, LLC The OptimalCloud v5.0 Open Redirect",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/991714"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T06:45:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "Optimal IdM OptimalCloud social redirect",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113384",
"datePublished": "2026-10-20T11:00:12.874Z",
"dateReserved": "2026-10-20T04:40:48.701Z",
"dateUpdated": "2026-10-20T11:00:12.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113383 (GCVE-0-2026-113383)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:45 – Updated: 2026-10-20 10:45
VLAI
EPSS
VEX
Title
Optimal IdM OptimalCloud Login cross site scripting
Summary
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422656 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422656/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113383 | third-party-advisory |
| https://vuldb.com/submit/991713 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Optimal IdM | OptimalCloud |
Affected:
5.0
cpe:2.3:a:optimal_idm:optimalcloud:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:optimal_idm:optimalcloud:*:*:*:*:*:*:*:*"
],
"product": "OptimalCloud",
"vendor": "Optimal IdM",
"versions": [
{
"status": "affected",
"version": "5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexandre Rodrigo (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:45:12.816Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422656 | Optimal IdM OptimalCloud Login cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422656"
},
{
"name": "VDB-422656 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422656/cti"
},
{
"name": "CVE-2026-113383 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113383"
},
{
"name": "Submit #991713 | Optimal IdM The OptimalCloud v5.0 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/991713"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T06:45:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "Optimal IdM OptimalCloud Login cross site scripting",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113383",
"datePublished": "2026-10-20T10:45:12.816Z",
"dateReserved": "2026-10-20T04:40:44.790Z",
"dateUpdated": "2026-10-20T10:45:12.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113358 (GCVE-0-2026-113358)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-20 10:41
VLAI
EPSS
VEX
Title
LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
Summary
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gist.github.com/kazisabu/073510cb5675d980… | exploittechnical-description |
| https://github.com/LavaLite/framework/blob/226265… | technical-description |
| https://github.com/LavaLite/framework/blob/226265… | technical-description |
| https://github.com/LavaLite/cms/releases/tag/v10.1.2 | productrelease-notes |
| https://www.vulncheck.com/advisories/lavalite-cms… | third-party-advisory |
Impacted products
Date Public
2026-09-19 06:25
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/lavalite/cms",
"product": "cms",
"repo": "https://github.com/LavaLite/cms",
"vendor": "lavalite",
"versions": [
{
"lessThanOrEqual": "10.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lavalite:lavalite:*:*:*:*:*:*:*:*",
"versionEndIncluding": "10.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kazi Sabbir"
}
],
"datePublic": "2026-09-19T06:25:32.000Z",
"descriptions": [
{
"lang": "en",
"value": "LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:41:42.303Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://gist.github.com/kazisabu/073510cb5675d9803cbee4f7c29810e0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/LavaLite/framework/blob/22626571904ad10befd78dca8cc2ad1a6d08396f/src/Litepie/Filer/routes/web.php"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/LavaLite/framework/blob/22626571904ad10befd78dca8cc2ad1a6d08396f/src/Litepie/Filer/Http/Controllers/FileController.php"
},
{
"name": "cms v10.1.2 Release Notes",
"tags": [
"product",
"release-notes"
],
"url": "https://github.com/LavaLite/cms/releases/tag/v10.1.2"
},
{
"name": "VulnCheck Advisory: LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-missing-authentication-via-filer-download-routes"
}
],
"title": "LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113358",
"datePublished": "2026-10-20T10:41:42.303Z",
"dateReserved": "2026-10-20T01:07:48.114Z",
"dateUpdated": "2026-10-20T10:41:42.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113357 (GCVE-0-2026-113357)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-20 10:41
VLAI
EPSS
VEX
Title
@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
Summary
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/tester-army/e2e/pull/1161 | patchissue-tracking |
| https://github.com/tester-army/e2e/commit/ce4dac3… | patch |
| https://github.com/tester-army/e2e/releases/tag/%… | release-notes |
| https://github.com/tester-army/e2e/blob/37e946907… | technical-description |
| https://www.vulncheck.com/advisories/e2e-dev-gith… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tester-army | @e2e-dev/github |
Affected:
0 , < 0.4.1
(semver)
|
Date Public
2026-10-15 09:58
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40e2e-dev/github",
"product": "@e2e-dev/github",
"repo": "https://github.com/tester-army/e2e",
"vendor": "tester-army",
"versions": [
{
"lessThan": "0.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brandon Tarr"
}
],
"datePublic": "2026-10-15T09:58:23.000Z",
"descriptions": [
{
"lang": "en",
"value": "@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:41:41.607Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/tester-army/e2e/pull/1161"
},
{
"tags": [
"patch"
],
"url": "https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc"
},
{
"name": "@e2e-dev/github %40e2e-dev%2Fgithub%400.4.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts"
},
{
"name": "VulnCheck Advisory: @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-marker"
}
],
"title": "@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113357",
"datePublished": "2026-10-20T10:41:41.607Z",
"dateReserved": "2026-10-20T01:07:47.767Z",
"dateUpdated": "2026-10-20T10:41:41.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113356 (GCVE-0-2026-113356)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-20 10:41
VLAI
EPSS
VEX
Title
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
Summary
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Severity
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/dokuwiki/dokuwiki/issues/4752 | issue-tracking |
| https://gist.github.com/sebastianosrt/a0c0252ca33… | exploittechnical-description |
| https://github.com/dokuwiki/dokuwiki/commit/15318… | patch |
| https://github.com/dokuwiki/dokuwiki/releases/tag… | release-notes |
| https://github.com/dokuwiki/dokuwiki/blob/b61db59… | technical-description |
| https://www.vulncheck.com/advisories/dokuwiki-bef… | third-party-advisory |
Impacted products
Date Public
2026-09-02 17:46
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dokuwiki/dokuwiki",
"product": "DokuWiki",
"repo": "https://github.com/dokuwiki/dokuwiki",
"vendor": "DokuWiki",
"versions": [
{
"lessThan": "2026-07-14c",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dokuwiki:dokuwiki:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026-07-14c",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "sebsrt"
}
],
"datePublic": "2026-09-02T17:46:13.000Z",
"descriptions": [
{
"lang": "en",
"value": "DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:41:40.897Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/dokuwiki/dokuwiki/issues/4752"
},
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://gist.github.com/sebastianosrt/a0c0252ca335e8e8b2c96fecf1f64538"
},
{
"tags": [
"patch"
],
"url": "https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681"
},
{
"name": "DokuWiki release-2026-07-14c Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/dokuwiki/dokuwiki/releases/tag/release-2026-07-14c"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dokuwiki/dokuwiki/blob/b61db59a8091fc992ac02959a9a09b576cc43ce0/inc/Draft.php#L122"
},
{
"name": "VulnCheck Advisory: DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dokuwiki-before-2026-07-14c-php-object-injection-via-draft-race-condition"
}
],
"title": "DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113356",
"datePublished": "2026-10-20T10:41:40.897Z",
"dateReserved": "2026-10-20T01:07:47.423Z",
"dateUpdated": "2026-10-20T10:41:40.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113355 (GCVE-0-2026-113355)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-20 10:41
VLAI
EPSS
VEX
Title
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
Summary
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Severity
4.8 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/chatwoot/chatwoot/pull/14140 | patchissue-tracking |
| https://github.com/chatwoot/chatwoot/commit/2192a… | patch |
| https://github.com/chatwoot/chatwoot/releases/tag… | release-notes |
| https://github.com/chatwoot/chatwoot/blob/88ffa32… | technical-description |
| https://www.vulncheck.com/advisories/chatwoot-bef… | third-party-advisory |
Impacted products
Date Public
2026-04-23 12:36
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/chatwoot/chatwoot",
"product": "chatwoot",
"repo": "https://github.com/chatwoot/chatwoot",
"vendor": "chatwoot",
"versions": [
{
"lessThan": "4.14.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ostorlab"
}
],
"datePublic": "2026-04-23T12:36:09.000Z",
"descriptions": [
{
"lang": "en",
"value": "Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:41:40.212Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/chatwoot/chatwoot/pull/14140"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chatwoot/chatwoot/commit/2192af80f405c70e3021191ff8b3f7e539c35e9d"
},
{
"name": "chatwoot v4.14.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/chatwoot/chatwoot/releases/tag/v4.14.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chatwoot/chatwoot/blob/88ffa329eb6e18ae06b608d8b4bab96c0e1b8f44/lib/custom_markdown_renderer.rb#L75-L84"
},
{
"name": "VulnCheck Advisory: Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/chatwoot-before-4.14.0-stored-xss-via-help-center-video-embed-links"
}
],
"title": "Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113355",
"datePublished": "2026-10-20T10:41:40.212Z",
"dateReserved": "2026-10-20T01:07:47.081Z",
"dateUpdated": "2026-10-20T10:41:40.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}