{"schema_version":"2","view":"grouped","data":[{"id":56284,"cve_ids":["CVE-2026-115994"],"payload":{"kind":"advisory","title":"BOLA Allows Cross-Project Target Tampering","summary":"BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.","evidence":"cve:CVE-2026-115994","products":[{"name":{"value":"cervantes","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115994","aliases":["CVE-2026-115994"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"CervantesSec","product":"cervantes","versions":[{"status":"affected","version":"alpha 0.3","versionType":"custom","lessThanOrEqual":"1.3-beta"},{"status":"unaffected","version":"v.1.4.0-beta"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T09:04:02.750Z","provider":"cve","references":["https://www.grayback.es/advisories","https://www.grayback.es/en/advisories"],"provider_metadata":{"cna":{"orgId":"772f0079-75c2-41ca-913e-d9072716578b","shortName":"Grayback","dateUpdated":"2026-10-24T09:04:02.750Z"}}},"related_cves":[{"value":"CVE-2026-115994","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40363739-1831-4c1c-846b-0b7e9ee3d835","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115994","advisory_id":"40363739-1831-4c1c-846b-0b7e9ee3d835","event_types":["advisory"],"published_at":"2026-10-25T16:12:19.442107+00:00","technologies":["cervantes","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T09:04:02.75+00:00","detail_url":"/advisories/advisory%3A40363739-1831-4c1c-846b-0b7e9ee3d835","group":{"id":"advisory:40363739-1831-4c1c-846b-0b7e9ee3d835","revision":1,"primary_event_id":55807,"change":"published","superseded_by":[],"changed":{"id":55807,"cve_ids":["CVE-2026-115994"],"payload":{"kind":"advisory","title":"BOLA Allows Cross-Project Target Tampering","summary":"BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.","evidence":"cve:CVE-2026-115994","products":[{"name":{"value":"cervantes","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115994","aliases":["CVE-2026-115994"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"CervantesSec","product":"cervantes","versions":[{"status":"affected","version":"alpha 0.3","versionType":"custom","lessThanOrEqual":"1.3-beta"},{"status":"unaffected","version":"v.1.4.0-beta"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T09:04:02.750Z","provider":"cve","references":["https://www.grayback.es/advisories","https://www.grayback.es/en/advisories"],"provider_metadata":{"cna":{"orgId":"772f0079-75c2-41ca-913e-d9072716578b","shortName":"Grayback","dateUpdated":"2026-10-24T09:04:02.750Z"}}},"related_cves":[{"value":"CVE-2026-115994","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40363739-1831-4c1c-846b-0b7e9ee3d835","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115994","advisory_id":"40363739-1831-4c1c-846b-0b7e9ee3d835","event_types":["advisory"],"published_at":"2026-10-25T16:12:19.442107+00:00","technologies":["cervantes","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T09:04:02.75+00:00","detail_url":"/events/55807"},"members":[{"id":55807,"cve_ids":["CVE-2026-115994"],"payload":{"kind":"advisory","title":"BOLA Allows Cross-Project Target Tampering","summary":"BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.","evidence":"cve:CVE-2026-115994","products":[{"name":{"value":"cervantes","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115994","aliases":["CVE-2026-115994"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"CervantesSec","product":"cervantes","versions":[{"status":"affected","version":"alpha 0.3","versionType":"custom","lessThanOrEqual":"1.3-beta"},{"status":"unaffected","version":"v.1.4.0-beta"}],"defaultStatus":"unaffected"}],"modified":"2026-10-24T09:04:02.750Z","provider":"cve","references":["https://www.grayback.es/advisories","https://www.grayback.es/en/advisories"],"provider_metadata":{"cna":{"orgId":"772f0079-75c2-41ca-913e-d9072716578b","shortName":"Grayback","dateUpdated":"2026-10-24T09:04:02.750Z"}}},"related_cves":[{"value":"CVE-2026-115994","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:40363739-1831-4c1c-846b-0b7e9ee3d835","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115994","advisory_id":"40363739-1831-4c1c-846b-0b7e9ee3d835","event_types":["advisory"],"published_at":"2026-10-25T16:12:19.442107+00:00","technologies":["cervantes","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T09:04:02.75+00:00","detail_url":"/events/55807"}]}}],"next_after":56284,"next_before":56284}