{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Sterling External Authentication Server versions 6.1.1.x ant\u00e9rieures \u00e0 6.1.1.3 GA",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server Liberty versions 17.0.0.3 \u00e0 26.0.0.3 sans le correctif APAR PH70510",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar AI Assistant pour QRadar SIEM versions ant\u00e9rieures \u00e0 1.4.0",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Secure Proxy versions 6.1.0.x ant\u00e9rieures \u00e0 6.1.0.4 GA",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Secure Proxy versions 6.2.1.x ant\u00e9rieures \u00e0 6.2.1.2 GA",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-26007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26007"
    },
    {
      "name": "CVE-2026-21933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21933"
    },
    {
      "name": "CVE-2026-21932",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21932"
    },
    {
      "name": "CVE-2026-27205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27205"
    },
    {
      "name": "CVE-2026-27025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27025"
    },
    {
      "name": "CVE-2026-22029",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22029"
    },
    {
      "name": "CVE-2026-22030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22030"
    },
    {
      "name": "CVE-2026-21925",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21925"
    },
    {
      "name": "CVE-2026-27024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27024"
    },
    {
      "name": "CVE-2020-10878",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10878"
    },
    {
      "name": "CVE-2025-68161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
    },
    {
      "name": "CVE-2026-28351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28351"
    },
    {
      "name": "CVE-2026-21884",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21884"
    },
    {
      "name": "CVE-2020-10543",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10543"
    },
    {
      "name": "CVE-2026-27199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27199"
    },
    {
      "name": "CVE-2026-26013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26013"
    },
    {
      "name": "CVE-2020-12723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-12723"
    },
    {
      "name": "CVE-2026-24842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
    },
    {
      "name": "CVE-2026-23950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23950"
    },
    {
      "name": "CVE-2026-2327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2327"
    },
    {
      "name": "CVE-2026-27888",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27888"
    },
    {
      "name": "CVE-2026-29786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29786"
    },
    {
      "name": "CVE-2026-25528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25528"
    },
    {
      "name": "CVE-2025-40909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40909"
    },
    {
      "name": "CVE-2026-25639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
    },
    {
      "name": "CVE-2026-21945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21945"
    },
    {
      "name": "CVE-2025-12194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12194"
    },
    {
      "name": "CVE-2026-27026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27026"
    },
    {
      "name": "CVE-2026-27212",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27212"
    },
    {
      "name": "CVE-2026-24688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24688"
    },
    {
      "name": "CVE-2026-29063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
    },
    {
      "name": "CVE-2026-27628",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27628"
    }
  ],
  "initial_release_date": "2026-04-10T00:00:00",
  "last_revision_date": "2026-04-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0424",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-04-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2026-04-06",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7268602",
      "url": "https://www.ibm.com/support/pages/node/7268602"
    },
    {
      "published_at": "2026-04-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7268724",
      "url": "https://www.ibm.com/support/pages/node/7268724"
    },
    {
      "published_at": "2026-04-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7268726",
      "url": "https://www.ibm.com/support/pages/node/7268726"
    },
    {
      "published_at": "2026-04-06",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7268604",
      "url": "https://www.ibm.com/support/pages/node/7268604"
    },
    {
      "published_at": "2026-04-06",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7268649",
      "url": "https://www.ibm.com/support/pages/node/7268649"
    },
    {
      "published_at": "2026-04-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7268725",
      "url": "https://www.ibm.com/support/pages/node/7268725"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Confluence Data Center versions 10.x ant\u00e9rieures \u00e0 10.2.10",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions 11.x ant\u00e9rieures \u00e0 11.3.4",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Server versions ant\u00e9rieures \u00e0 9.12.33",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.2.19",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Data Center versions 10.x ant\u00e9rieures \u00e0 10.3.19",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 9.12.34",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.3.19",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.3.13",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Server versions 10.x ant\u00e9rieures \u00e0 10.3.16",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Data Center versions 11.x ant\u00e9rieures \u00e0 11.3.4",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-33871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
    },
    {
      "name": "CVE-2023-1370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1370"
    },
    {
      "name": "CVE-2021-0341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
    },
    {
      "name": "CVE-2023-48631",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48631"
    },
    {
      "name": "CVE-2026-23745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23745"
    },
    {
      "name": "CVE-2026-33870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
    },
    {
      "name": "CVE-2026-22029",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22029"
    },
    {
      "name": "CVE-2023-3635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
    },
    {
      "name": "CVE-2026-26960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26960"
    },
    {
      "name": "CVE-2024-45801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45801"
    },
    {
      "name": "CVE-2021-31597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31597"
    },
    {
      "name": "CVE-2026-24842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24842"
    },
    {
      "name": "CVE-2026-23950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23950"
    },
    {
      "name": "CVE-2024-29371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
    },
    {
      "name": "CVE-2024-47875",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47875"
    },
    {
      "name": "CVE-2026-25639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
    },
    {
      "name": "CVE-2025-66020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66020"
    },
    {
      "name": "CVE-2022-1471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471"
    },
    {
      "name": "CVE-2026-29063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
    },
    {
      "name": "CVE-2026-31802",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31802"
    },
    {
      "name": "CVE-2026-25547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25547"
    },
    {
      "name": "CVE-2025-48734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48734"
    }
  ],
  "initial_release_date": "2026-04-22T00:00:00",
  "last_revision_date": "2026-04-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0479",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-04-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
  "vendor_advisories": [
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26754",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26754"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16542",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16542"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26657",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26657"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16551",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16551"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26764",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26764"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103476",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103476"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103467",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103467"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103471",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103471"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103469",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103469"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103475",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103475"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16544",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16544"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103470",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103470"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103472",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103472"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103612",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103612"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103539",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103539"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103474",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103474"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26666",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26666"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16557",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16557"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103517",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103517"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16550",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16550"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16540",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16540"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26765",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26765"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26763",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26763"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26760",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26760"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16552",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16552"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16556",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16556"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-102567",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-102567"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103473",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103473"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103516",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103516"
    },
    {
      "published_at": "2026-04-21",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103518",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103518"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Sterling Connect:Direct for Microsoft Windows versions 6.3.0.x ant\u00e9rieures \u00e0 6.3.0.6_iFix048",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server - Liberty versions 17.0.0.3 \u00e0 26.0.0.4 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "WebSphere",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Informix Dynamic Server versions 15.0 sans le correctif de s\u00e9curit\u00e9  HQ 3.2.2",
      "product": {
        "name": "Informix Dynamic Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Informix Dynamic Server versions 12.10.x sans le correctif de s\u00e9curit\u00e9  HQ 3.2.2",
      "product": {
        "name": "Informix Dynamic Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Informix Dynamic Server versions 14.10 sans le correctif de s\u00e9curit\u00e9  HQ 3.2.2",
      "product": {
        "name": "Informix Dynamic Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Connect:Direct for Microsoft Windows versions 6.4.0.x ant\u00e9rieures \u00e0 6.4.0.4_iFix019",
      "product": {
        "name": "Sterling Connect:Direct",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "greffon Security QRadar Log Management AQL versions 1.x ant\u00e9rieures \u00e0 1.1.5",
      "product": {
        "name": "Security QRadar Log Management AQL",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-22737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22737"
    },
    {
      "name": "CVE-2026-22610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22610"
    },
    {
      "name": "CVE-2026-33186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
    },
    {
      "name": "CVE-2026-3621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3621"
    },
    {
      "name": "CVE-2025-66412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66412"
    },
    {
      "name": "CVE-2025-66035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66035"
    },
    {
      "name": "CVE-2026-2391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2391"
    },
    {
      "name": "CVE-2025-15284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
    },
    {
      "name": "CVE-2026-22029",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22029"
    },
    {
      "name": "CVE-2026-24051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24051"
    },
    {
      "name": "CVE-2021-23337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23337"
    },
    {
      "name": "CVE-2026-4800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
    },
    {
      "name": "CVE-2025-67030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
    },
    {
      "name": "CVE-2026-0540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0540"
    },
    {
      "name": "CVE-2026-33532",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33532"
    },
    {
      "name": "CVE-2025-68470",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68470"
    },
    {
      "name": "CVE-2026-33228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33228"
    },
    {
      "name": "CVE-2026-27970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27970"
    },
    {
      "name": "CVE-2026-2950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2950"
    },
    {
      "name": "CVE-2024-29371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29371"
    },
    {
      "name": "CVE-2025-15599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15599"
    },
    {
      "name": "CVE-2024-31033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31033"
    },
    {
      "name": "CVE-2026-26278",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26278"
    },
    {
      "name": "CVE-2026-22735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22735"
    },
    {
      "name": "CVE-2026-27601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27601"
    },
    {
      "name": "CVE-2026-32141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32141"
    },
    {
      "name": "CVE-2025-13465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
    }
  ],
  "initial_release_date": "2026-04-30T00:00:00",
  "last_revision_date": "2026-04-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0523",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-04-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2026-04-27",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7270805",
      "url": "https://www.ibm.com/support/pages/node/7270805"
    },
    {
      "published_at": "2026-04-27",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7270827",
      "url": "https://www.ibm.com/support/pages/node/7270827"
    },
    {
      "published_at": "2026-04-27",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7270869",
      "url": "https://www.ibm.com/support/pages/node/7270869"
    },
    {
      "published_at": "2026-04-27",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7270820",
      "url": "https://www.ibm.com/support/pages/node/7270820"
    },
    {
      "published_at": "2026-04-27",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7270845",
      "url": "https://www.ibm.com/support/pages/node/7270845"
    },
    {
      "published_at": "2026-04-27",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7270868",
      "url": "https://www.ibm.com/support/pages/node/7270868"
    },
    {
      "published_at": "2026-04-27",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7270775",
      "url": "https://www.ibm.com/support/pages/node/7270775"
    },
    {
      "published_at": "2026-04-24",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7270692",
      "url": "https://www.ibm.com/support/pages/node/7270692"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 10.3.20",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 11.3.5",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 10.2.11",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Server versions ant\u00e9rieures \u00e0 10.3.20",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 11.3.5",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Confluence Data Center versions ant\u00e9rieures \u00e0 9.2.20",
      "product": {
        "name": "Confluence",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 9.12.35",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Service Management Data Center versions ant\u00e9rieures \u00e0 10.3.20",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    },
    {
      "description": "Jira Software Data Center versions ant\u00e9rieures \u00e0 11.3.5",
      "product": {
        "name": "Jira",
        "vendor": {
          "name": "Atlassian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-24734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24734"
    },
    {
      "name": "CVE-2026-29145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
    },
    {
      "name": "CVE-2026-22029",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22029"
    },
    {
      "name": "CVE-2026-29146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29146"
    },
    {
      "name": "CVE-2026-33750",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33750"
    },
    {
      "name": "CVE-2026-26960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26960"
    },
    {
      "name": "CVE-2026-22732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22732"
    },
    {
      "name": "CVE-2026-34487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34487"
    },
    {
      "name": "CVE-2026-29062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29062"
    },
    {
      "name": "CVE-2026-29786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29786"
    },
    {
      "name": "CVE-2026-25639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
    },
    {
      "name": "CVE-2026-29129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29129"
    },
    {
      "name": "CVE-2026-34483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34483"
    },
    {
      "name": "CVE-2026-24880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24880"
    },
    {
      "name": "CVE-2026-31802",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31802"
    }
  ],
  "initial_release_date": "2026-05-20T00:00:00",
  "last_revision_date": "2026-05-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0621",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Atlassian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Atlassian",
  "vendor_advisories": [
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103710",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103710"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16574",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16574"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26786",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26786"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16576",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16576"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103709",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103709"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103708",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103708"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16588",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16588"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26781",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26781"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16571",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16571"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16573",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16573"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103633",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103633"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26778",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26778"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26780",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26780"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26788",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26788"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103713",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103713"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16587",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16587"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26793",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26793"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26785",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26785"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16577",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16577"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103712",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103712"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26787",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26787"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16578",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16578"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103707",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103707"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian CONFSERVER-103647",
      "url": "https://jira.atlassian.com/browse/CONFSERVER-103647"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSWSERVER-26782",
      "url": "https://jira.atlassian.com/browse/JSWSERVER-26782"
    },
    {
      "published_at": "2026-05-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Atlassian JSDSERVER-16575",
      "url": "https://jira.atlassian.com/browse/JSDSERVER-16575"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "react-router",
          "vendor": "remix-run",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.12.0"
            }
          ]
        },
        {
          "product": "@remix-run/router",
          "vendor": "remix-run",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.23.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:shopify:remix-run\\/react:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "EFF13A05-C167-4C47-8D8E-A1821F69C0B0",
              "versionEndExcluding": "1.23.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "6928DE33-6137-4682-8610-1A6646F1B2A5",
              "versionEndIncluding": "7.11.0",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (\u003cBrowserRouter\u003e) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0."
    },
    {
      "lang": "es",
      "value": "React Router es un router para React. En las versiones de @remix-run/router anteriores a la 1.23.2 y de react-router de la 7.0.0 a la 7.11.0, las redirecciones de navegaci\u00f3n abierta de SPA de React Router (y Remix v1/v2) que se originan en cargadores o acciones en el Modo Framework, Modo Datos, o los modos RSC inestables pueden resultar en URLs inseguras que causan la ejecuci\u00f3n no intencionada de javascript en el cliente. Esto es solo un problema si se est\u00e1n creando rutas de redirecci\u00f3n a partir de contenido no confiable o a trav\u00e9s de una redirecci\u00f3n abierta. No hay impacto si se est\u00e1 utilizando el Modo Declarativo (). Este problema ha sido parcheado en la versi\u00f3n 1.23.2 de @remix-run/router y la versi\u00f3n 7.12.0 de react-router."
    }
  ],
  "id": "CVE-2026-22029",
  "lastModified": "2026-06-17T10:19:23.220",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22029",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-13T04:55:53.265498Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-10T03:15:48.870",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.11.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "react-router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.12.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.23.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@remix-run/router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.23.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-22029"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-08T20:54:18Z",
    "nvd_published_at": "2026-01-10T03:15:48Z",
    "severity": "HIGH"
  },
  "details": "React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in [Framework Mode](https://reactrouter.com/start/modes#framework), [Data Mode](https://reactrouter.com/start/modes#data), or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if developers are creating redirect paths from untrusted content or via an open redirect.\n\n\u003e [!NOTE]\n\u003e This does not impact applications that use [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`\u003cBrowserRouter\u003e`).",
  "id": "GHSA-2w69-qvjg-hvjx",
  "modified": "2026-01-11T14:54:13Z",
  "published": "2026-01-08T20:54:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22029"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/remix-run/react-router"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "React Router vulnerable to XSS via Open Redirects"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "heroic-games-launcher-2.18.1-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the heroic-games-launcher-2.18.1-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10069",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10069-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22029 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22029/"
      }
    ],
    "title": "heroic-games-launcher-2.18.1-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-01-19T00:00:00Z",
      "generator": {
        "date": "2026-01-19T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10069-1",
      "initial_release_date": "2026-01-19T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-01-19T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "heroic-games-launcher-2.18.1-2.1.aarch64",
                "product": {
                  "name": "heroic-games-launcher-2.18.1-2.1.aarch64",
                  "product_id": "heroic-games-launcher-2.18.1-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "heroic-games-launcher-2.18.1-2.1.ppc64le",
                "product": {
                  "name": "heroic-games-launcher-2.18.1-2.1.ppc64le",
                  "product_id": "heroic-games-launcher-2.18.1-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "heroic-games-launcher-2.18.1-2.1.s390x",
                "product": {
                  "name": "heroic-games-launcher-2.18.1-2.1.s390x",
                  "product_id": "heroic-games-launcher-2.18.1-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "heroic-games-launcher-2.18.1-2.1.x86_64",
                "product": {
                  "name": "heroic-games-launcher-2.18.1-2.1.x86_64",
                  "product_id": "heroic-games-launcher-2.18.1-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heroic-games-launcher-2.18.1-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.aarch64"
        },
        "product_reference": "heroic-games-launcher-2.18.1-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heroic-games-launcher-2.18.1-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.ppc64le"
        },
        "product_reference": "heroic-games-launcher-2.18.1-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heroic-games-launcher-2.18.1-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.s390x"
        },
        "product_reference": "heroic-games-launcher-2.18.1-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heroic-games-launcher-2.18.1-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.x86_64"
        },
        "product_reference": "heroic-games-launcher-2.18.1-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-22029",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22029"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "React Router is a router for React. In @remix-run/router version prior to 1.23.2. and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (\u003cBrowserRouter\u003e) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.aarch64",
          "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.ppc64le",
          "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.s390x",
          "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22029",
          "url": "https://www.suse.com/security/cve/CVE-2026-22029"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256470 for CVE-2026-22029",
          "url": "https://bugzilla.suse.com/1256470"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.aarch64",
            "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.ppc64le",
            "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.s390x",
            "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.aarch64",
            "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.ppc64le",
            "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.s390x",
            "openSUSE Tumbleweed:heroic-games-launcher-2.18.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-22029"
    }
  ]
}