CVE-2026-59931 (GCVE-0-2026-59931)

Vulnerability from cvelistv5 – Published: 2026-07-28 17:27 – Updated: 2026-07-28 18:13
VLAI
Title
PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Summary
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 18:13 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7838 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
PHPOffice PhpSpreadsheet Affected: >= 4.0.0, < 5.8.1
Affected: >= 3.3.0, < 3.10.7
Affected: >= 2.2.0, < 2.4.7
Affected: >= 2.0.0, < 2.1.18
Affected: < 1.30.6
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59931",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T18:13:13.134222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T18:13:17.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PhpSpreadsheet",
          "vendor": "PHPOffice",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.8.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.10.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.4.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.18"
            },
            {
              "status": "affected",
              "version": "\u003c 1.30.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL\u0027s host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP\u0027s HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell\u0027s calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T17:27:27.300Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"
        },
        {
          "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6hq5-7373-42rg",
        "discovery": "UNKNOWN"
      },
      "title": "PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59931",
    "datePublished": "2026-07-28T17:27:27.300Z",
    "dateReserved": "2026-07-07T18:20:06.126Z",
    "dateUpdated": "2026-07-28T18:13:17.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59931",
      "date": "2026-10-27",
      "epss": "0.00474",
      "percentile": "0.40758"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "PhpSpreadsheet",
                "vendor": "PHPOffice",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0, \u003c 5.8.1"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.3.0, \u003c 3.10.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.2.0, \u003c 2.4.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0, \u003c 2.1.18"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 1.30.6"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL\u0027s host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP\u0027s HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell\u0027s calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."
          },
          {
            "lang": "es",
            "value": "PhpSpreadsheet es una biblioteca PHP pura para leer y escribir archivos de hoja de c\u00e1lculo. En las versiones 4.0.0 a 5.8.0, 3.3.0 a 3.10.6, 2.2.0 a 2.4.6, 2.0.0 a 2.1.17, y todas las versiones hasta la 1.30.5 inclusive, la lista blanca de dominios de WEBSERVICE() puede ser evadida a trav\u00e9s de una redirecci\u00f3n HTTP (SSRF). En Calculation/Web/Service.php, el m\u00e9todo webService() valida el host de una URL contra la lista blanca establecida a trav\u00e9s de Spreadsheet::setDomainWhiteList(), luego obtiene el contenido con file_get_contents($url, false, $ctx); debido a que el envoltorio de flujo HTTP de PHP sigue las redirecciones 301/302 autom\u00e1ticamente (hasta 20 saltos) y el objetivo de la redirecci\u00f3n nunca se revalida, un atacante que puede activar una redirecci\u00f3n desde un dominio en la lista blanca puede alcanzar URLs arbitrarias, incluyendo direcciones internas. Un atacante capaz de subir archivos XLSX a una aplicaci\u00f3n que utiliza setDomainWhiteList() y getCalculatedValue() puede lograr un SSRF de lectura completa, devolviendo hasta 32.767 bytes del cuerpo de la respuesta como valor calculado de una celda, lo que permite la exfiltraci\u00f3n de metadatos de la nube (credenciales de AWS/GCP/Azure a trav\u00e9s de http://169.254.169.254/), el acceso a servicios solo internos y el escaneo de puertos internos (el puerto no se valida). Este problema ha sido solucionado en las versiones 5.8.1, 3.10.7, 2.4.7, 2.1.18 y 1.30.6."
          }
        ],
        "id": "CVE-2026-59931",
        "lastModified": "2026-10-23T23:10:00.157",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59931",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T18:13:13.134222Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-28T18:17:22.873",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59931",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-28T18:13:13.134222Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-28T18:12:51.892Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "PhpSpreadsheet",
              "vendor": "PHPOffice",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0, \u003c 5.8.1"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.3.0, \u003c 3.10.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.2.0, \u003c 2.4.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.0, \u003c 2.1.18"
                },
                {
                  "status": "affected",
                  "version": "\u003c 1.30.6"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL\u0027s host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP\u0027s HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell\u0027s calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-28T17:27:27.300Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hq5-7373-42rg"
            },
            {
              "name": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7ef7b25e8548a6ded79dac74e2e2c7acdac38d8d"
            },
            {
              "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.30.6"
            },
            {
              "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.1.18"
            },
            {
              "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/2.4.7"
            },
            {
              "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/3.10.7"
            },
            {
              "name": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/5.8.1"
            }
          ],
          "source": {
            "advisory": "GHSA-6hq5-7373-42rg",
            "discovery": "UNKNOWN"
          },
          "title": "PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-59931",
        "datePublished": "2026-07-28T17:27:27.300Z",
        "dateReserved": "2026-07-07T18:20:06.126Z",
        "dateUpdated": "2026-07-28T18:13:17.566Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.