{"schema_version":"2","view":"grouped","data":[{"id":63303,"cve_ids":["CVE-2026-57443"],"payload":{"kind":"advisory","title":"SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests","summary":"SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=[\"*\"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.","evidence":"cve:CVE-2026-57443","products":[{"name":{"value":"SCBE-AETHERMOORE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-57443","aliases":["CVE-2026-57443"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"issdandavis","product":"SCBE-AETHERMOORE","versions":[{"status":"affected","version":">= 4.0.2, < 4.2.1"}]}],"modified":"2026-09-29T17:45:46.289Z","provider":"cve","references":["https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57443","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:44:13.690659Z"}}}],"references":[{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:45:46.289Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T20:37:52.116Z"}}},"related_cves":[{"value":"CVE-2026-57443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85bbd35a-0690-4462-9ff2-668b42ab65d8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-57443","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"products":[{"name":{"value":"scbe-aethermoore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.1.3","evidence":"/affected/0/versions"},{"value":"4.2.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q986-4x7x-gx39","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57443","advisory_id":"85bbd35a-0690-4462-9ff2-668b42ab65d8","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.234456+00:00","technologies":["core-cve","scbe-aethermoore"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T20:37:52.116+00:00","detail_url":"/advisories/advisory%3A85bbd35a-0690-4462-9ff2-668b42ab65d8","group":{"id":"advisory:85bbd35a-0690-4462-9ff2-668b42ab65d8","revision":1,"primary_event_id":62587,"change":"published","superseded_by":[],"changed":{"id":62587,"cve_ids":["CVE-2026-57443"],"payload":{"kind":"advisory","title":"SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests","summary":"SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=[\"*\"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.","evidence":"cve:CVE-2026-57443","products":[{"name":{"value":"SCBE-AETHERMOORE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-57443","aliases":["CVE-2026-57443"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"issdandavis","product":"SCBE-AETHERMOORE","versions":[{"status":"affected","version":">= 4.0.2, < 4.2.1"}]}],"modified":"2026-09-29T17:45:46.289Z","provider":"cve","references":["https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57443","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:44:13.690659Z"}}}],"references":[{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:45:46.289Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T20:37:52.116Z"}}},"related_cves":[{"value":"CVE-2026-57443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85bbd35a-0690-4462-9ff2-668b42ab65d8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-57443","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"products":[{"name":{"value":"scbe-aethermoore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.1.3","evidence":"/affected/0/versions"},{"value":"4.2.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q986-4x7x-gx39","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57443","advisory_id":"85bbd35a-0690-4462-9ff2-668b42ab65d8","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.234456+00:00","technologies":["core-cve","scbe-aethermoore"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-25T20:37:52.116+00:00","detail_url":"/events/62587"},"members":[{"id":62587,"cve_ids":["CVE-2026-57443"],"payload":{"kind":"advisory","title":"SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests","summary":"SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=[\"*\"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.","evidence":"cve:CVE-2026-57443","products":[{"name":{"value":"SCBE-AETHERMOORE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-57443","aliases":["CVE-2026-57443"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"issdandavis","product":"SCBE-AETHERMOORE","versions":[{"status":"affected","version":">= 4.0.2, < 4.2.1"}]}],"modified":"2026-09-29T17:45:46.289Z","provider":"cve","references":["https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57443","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:44:13.690659Z"}}}],"references":[{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:45:46.289Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T20:37:52.116Z"}}},"related_cves":[{"value":"CVE-2026-57443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85bbd35a-0690-4462-9ff2-668b42ab65d8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-57443","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"products":[{"name":{"value":"scbe-aethermoore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.1.3","evidence":"/affected/0/versions"},{"value":"4.2.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q986-4x7x-gx39","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57443","advisory_id":"85bbd35a-0690-4462-9ff2-668b42ab65d8","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.234456+00:00","technologies":["core-cve","scbe-aethermoore"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-25T20:37:52.116+00:00","detail_url":"/events/62587"}]}}],"next_after":63303,"next_before":63303}