GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0227

Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-08 07:57
VLAI
Title
[REVIVE-SA-2026-001] Revive Adserver Vulnerabilities
Summary
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-001 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-001 ------------------------------------------------------------------------ Date: 2026-01-14 Risk Level: High Applications affected: Revive Adserver Versions affected: <= 6.0.4 Versions not affected: >= 6.0.5 Website: https://www.revive-adserver.com/ ======================================================================== ======================================================================== Vulnerability 1: Format string injection ======================================================================== Vulnerability Type: Use of Externally-Controlled Format String [CWE-134] CVE-ID: CVE-2026-21640 Risk level: Low CVSS Base Score: 2.7 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L ======================================================================== Description ----------- Details ------- References ---------- https://hackerone.com/reports/3445332 https://github.com/revive-adserver/revive-adserver/commit/c40187d8 https://cwe.mitre.org/data/definitions/134.html ======================================================================== Vulnerability 2: Authorization Bypass ======================================================================== Vulnerability Type: Authorization Bypass Through User-Controlled Key [CWE-639] CVE-ID: CVE-2026-21641 Risk level: High CVSS Base Score: 7.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L ======================================================================== Description ----------- Details ------- References ---------- https://hackerone.com/reports/3445710 https://github.com/revive-adserver/revive-adserver/commit/f6059335 https://cwe.mitre.org/data/definitions/639.html ======================================================================== Vulnerability 3: Reflected XSS ======================================================================== Vulnerability Type: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) [CWE-79] CVE-ID: CVE-2026-21642 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ======================================================================== Description ----------- Details ------- References ---------- https://hackerone.com/reports/3470970 https://github.com/revive-adserver/revive-adserver/commit/e245a88 https://github.com/revive-adserver/revive-adserver/commit/0ebc96d https://cwe.mitre.org/data/definitions/79.html ======================================================================== Vulnerability 4: Reflected XSS ======================================================================== Vulnerability Type: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) [CWE-79] CVE-ID: CVE-2026-21663 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ======================================================================== Description ----------- Details ------- References ---------- https://hackerone.com/reports/3473696 https://github.com/revive-adserver/revive-adserver/commit/c130eb0 https://cwe.mitre.org/data/definitions/79.html ======================================================================== Vulnerability 5: Reflected XSS ======================================================================== Vulnerability Type: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) [CWE-79] CVE-ID: CVE-2026-21664 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ======================================================================== Description ----------- Details ------- References ---------- https://hackerone.com/reports/3468169 https://github.com/revive-adserver/revive-adserver/commit/e88e9ed https://github.com/revive-adserver/revive-adserver/commit/7a99f69 https://cwe.mitre.org/data/definitions/79.html ======================================================================== Solution ======================================================================== ======================================================================== Contact Information ======================================================================== The security contact for Revive Adserver can be reached at: <security AT revive-adserver DOT com>. -- Matteo Beccati On behalf of the Revive Adserver Team https://www.revive-adserver.com/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
unknown Revive Adserver Vulnerabilities Affected: unknown
guessed Create a notification for this product.
Credits
Matteo Beccati
Relationships
reference GCVE-1988-2026-0227 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-001\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-001\n------------------------------------------------------------------------\nDate:                  2026-01-14\nRisk Level:            High\nApplications affected: Revive Adserver\nVersions affected:     \u003c= 6.0.4\nVersions not affected: \u003e= 6.0.5\nWebsite:               https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\nVulnerability 1: Format string injection\n========================================================================\nVulnerability Type:    Use of Externally-Controlled Format String\n                       [CWE-134]\nCVE-ID:                CVE-2026-21640\nRisk level:            Low\nCVSS Base Score:       2.7\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3445332\nhttps://github.com/revive-adserver/revive-adserver/commit/c40187d8\nhttps://cwe.mitre.org/data/definitions/134.html\n\n\n========================================================================\nVulnerability 2: Authorization Bypass\n========================================================================\nVulnerability Type:    Authorization Bypass Through User-Controlled Key\n                       [CWE-639]\nCVE-ID:                CVE-2026-21641\nRisk level:            High\nCVSS Base Score:       7.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3445710\nhttps://github.com/revive-adserver/revive-adserver/commit/f6059335\nhttps://cwe.mitre.org/data/definitions/639.html\n\n\n========================================================================\nVulnerability 3: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21642\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3470970\nhttps://github.com/revive-adserver/revive-adserver/commit/e245a88\nhttps://github.com/revive-adserver/revive-adserver/commit/0ebc96d\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nVulnerability 4: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21663\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3473696\nhttps://github.com/revive-adserver/revive-adserver/commit/c130eb0\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nVulnerability 5: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21664\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3468169\nhttps://github.com/revive-adserver/revive-adserver/commit/e88e9ed\nhttps://github.com/revive-adserver/revive-adserver/commit/7a99f69\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\n\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/19"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/134.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/639.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/0ebc96d"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/7a99f69"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c130eb0"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c40187d8"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e245a88"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e88e9ed"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/f6059335"
        },
        {
          "url": "https://hackerone.com/reports/3445332"
        },
        {
          "url": "https://hackerone.com/reports/3445710"
        },
        {
          "url": "https://hackerone.com/reports/3468169"
        },
        {
          "url": "https://hackerone.com/reports/3470970"
        },
        {
          "url": "https://hackerone.com/reports/3473696"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-001"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-001] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-21640",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21641",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21642",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21664",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0227",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/19",
            "automated": true,
            "contentSha256": "3cc90b37896729de9b4382b0e85f8f06d38ebf529ecfe7b27dd12029dffd23ac",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-14T12:39:23Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0227"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-08T07:57:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0227"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.