{"schema_version":"1","data":[{"id":4094,"advisory_id":"b5da881f-b5fa-4606-aebf-76d64b2237f0","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53626","source_published_at":"2026-09-25T18:37:53.046+00:00","published_at":"2026-10-24T21:45:49.623949+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-53626"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Arbitrary Document Read via Form Context Authorization Bypass","summary":"GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.","evidence":"cve:CVE-2026-53626","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53626","aliases":["CVE-2026-53626"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 11.0.5, < 11.0.8"}]}],"modified":"2026-09-30T00:04:14.035Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-q9rc-v6vm-q5mm","https://github.com/glpi-project/glpi/commit/e984bf1ba435cee7319679df842c61b756baf191","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53626","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T00:03:56.216181Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T00:04:14.035Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:37:53.046Z"}}},"related_cves":[{"value":"CVE-2026-53626","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4093,"advisory_id":"c4229623-5e6f-4995-bff1-1a9f90da4f65","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53628","source_published_at":"2026-09-25T18:28:25.584+00:00","published_at":"2026-10-24T21:45:49.016804+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-53628"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Unallowed authentication method update by administrator","summary":"GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sync or Update auth, sync and 2FA right can change the authentication method and disable two-factor authentication for user accounts outside the administrator's entity scope. The affected user-account administration flow did not consistently enforce the target user's entity-scoped update permission. This issue is fixed in versions 11.0.8 and 10.0.26.","evidence":"cve:CVE-2026-53628","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-53628","aliases":["CVE-2026-53628"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 0.84, < 10.0.26"},{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-30T00:00:41.958Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-2hf7-pw75-7wcp","https://github.com/glpi-project/glpi/commit/27cc088f2b134fdcca0643b2485c9bfcc779bc4f","https://github.com/glpi-project/glpi/commit/f06a790d64ea18f8ad4ba5cf8236115dd882c364","https://github.com/glpi-project/glpi/releases/tag/10.0.26","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53628","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T00:00:31.822673Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T00:00:41.958Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:28:25.584Z"}}},"related_cves":[{"value":"CVE-2026-53628","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4092,"advisory_id":"0b5dbe2c-2544-45b7-a3d8-08a1f31902a9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48482","source_published_at":"2026-09-25T18:37:10.625+00:00","published_at":"2026-10-24T21:45:48.434955+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-48482"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: RCE via Form import","summary":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted illustration or scene identifier that traverses outside the intended custom-asset directory. The imported file can be written to an executable server location, allowing a malicious script to be invoked remotely. This issue is fixed in version 11.0.8.","evidence":"cve:CVE-2026-48482","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-48482","aliases":["CVE-2026-48482"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.4,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-30T00:02:57.203Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-6whc-g4h2-98rm","https://github.com/glpi-project/glpi/commit/d817cb5c17e3368c89d4a561a43a777662b9da19","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-48482","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T00:02:48.285906Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T00:02:57.203Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:37:10.625Z"}}},"related_cves":[{"value":"CVE-2026-48482","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3894,"advisory_id":"1e61af77-e294-497f-92e5-5ed1a084563d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55214","source_published_at":"2026-09-25T18:33:03.953+00:00","published_at":"2026-10-24T21:42:53.289856+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-55214"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Stored XSS in suppliers","summary":"GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.","evidence":"cve:CVE-2026-55214","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-55214","aliases":["CVE-2026-55214"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 11.0.6, < 11.0.8"}]}],"modified":"2026-09-29T17:59:12.072Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-8v8p-w8mq-wqcg","https://github.com/glpi-project/glpi/commit/970786ed3b817c4c2bf90b8457b024ec566b1bfc","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-55214","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T17:58:35.910400Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:59:12.072Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:33:03.953Z"}}},"related_cves":[{"value":"CVE-2026-55214","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3893,"advisory_id":"5f340781-8bc0-403a-ac6e-7c2817e3ac41","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53610","source_published_at":"2026-09-25T18:34:43.674+00:00","published_at":"2026-10-24T21:42:52.695152+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-53610"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Reflected XSS in dashboards","summary":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8.","evidence":"cve:CVE-2026-53610","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53610","aliases":["CVE-2026-53610"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"ACTIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-29T17:57:14.916Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-76v9-ch69-g67r","https://github.com/glpi-project/glpi/commit/9b17a3b2b91070cf197dedae3286322a41c4bc92","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53610","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T17:55:15.182109Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:57:14.916Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:34:43.674Z"}}},"related_cves":[{"value":"CVE-2026-53610","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3892,"advisory_id":"dbce3910-3663-4328-8982-e27778ad7edf","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49469","source_published_at":"2026-09-25T18:25:43.769+00:00","published_at":"2026-10-24T21:42:52.132478+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-49469"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: LDAP filter injection in user import feature","summary":"GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.","evidence":"cve:CVE-2026-49469","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-49469","aliases":["CVE-2026-49469"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 0.70, < 10.0.26"},{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-29T18:00:54.072Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-3cgm-rj32-hfwf","https://github.com/glpi-project/glpi/commit/4fb3056bcd292b515acce96887f1376ce6d5aba8","https://github.com/glpi-project/glpi/commit/d413b48ea97b2f73ba30c90ae0d029aac860f71a","https://github.com/glpi-project/glpi/releases/tag/10.0.26","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-49469","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T18:00:05.834498Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T18:00:54.072Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:25:43.769Z"}}},"related_cves":[{"value":"CVE-2026-49469","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3080,"advisory_id":"86024a6f-6647-4634-85c6-1d87f8c86982","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49470","source_published_at":"2026-09-25T18:30:55.981+00:00","published_at":"2026-10-24T21:29:08.037038+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-49470"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force","summary":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8.","evidence":"cve:CVE-2026-49470","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-49470","aliases":["CVE-2026-49470"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-28T13:40:15.230Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-mcv8-4hfg-5x2x","https://github.com/glpi-project/glpi/commit/19a0e81a2b09fee43b3e2a603639fc9b61360c73","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-49470","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T13:40:06.632907Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T13:40:15.230Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:30:55.981Z"}}},"related_cves":[{"value":"CVE-2026-49470","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2263,"advisory_id":"fe060788-4757-40cf-a2f5-e02213b63e0f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53629","source_published_at":"2026-09-25T18:38:43.308+00:00","published_at":"2026-10-24T21:15:50.907778+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-53629"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: SQL injection in history tab","summary":"GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.","evidence":"cve:CVE-2026-53629","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53629","aliases":["CVE-2026-53629"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 9.4.0, < 10.0.26"},{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-25T19:45:17.922Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-cpcj-x335-5cmh","https://github.com/glpi-project/glpi/commit/1296798fb03295d07c1d97fa8483d1dbab59fef5","https://github.com/glpi-project/glpi/commit/80b86c0dcad2f6ece9b5da445d1c264a1dda3ce5","https://github.com/glpi-project/glpi/releases/tag/10.0.26","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53629","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:45:11.103391Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:45:17.922Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:38:43.308Z"}}},"related_cves":[{"value":"CVE-2026-53629","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2261,"advisory_id":"1103ab8a-12e0-458b-92ab-84979edf309a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-45801","source_published_at":"2026-09-25T18:27:33.123+00:00","published_at":"2026-10-24T21:15:49.71155+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-45801"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)","summary":"GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26.","evidence":"cve:CVE-2026-45801","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-45801","aliases":["CVE-2026-45801"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 0.72, < 10.0.26"},{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-25T19:41:40.597Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-3vhr-7p54-cqhw","https://github.com/glpi-project/glpi/commit/e9d8765122aafda5c61eba33bcbd8323569c8a53","https://github.com/glpi-project/glpi/commit/fb72d60cfc0e155f8f7707f0a2398bd5f17d7071","https://github.com/glpi-project/glpi/releases/tag/10.0.26","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-45801","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:41:33.012417Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:41:40.597Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:27:33.123Z"}}},"related_cves":[{"value":"CVE-2026-45801","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2249,"advisory_id":"d51dbdf6-2d1a-44bc-8cc0-3d0050d9c5c9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-55217","source_published_at":"2026-09-25T18:29:28.418+00:00","published_at":"2026-10-24T21:15:41.496896+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-55217"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Unallowed modfication of knowbase items comments and translations","summary":"GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.","evidence":"cve:CVE-2026-55217","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-55217","aliases":["CVE-2026-55217"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 0.85, < 10.0.26"},{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-25T19:05:01.467Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-xm3v-3g6q-g9q8","https://github.com/glpi-project/glpi/commit/1cbf69b99dfd0610f1c03a3f245f3b248e1bfde0","https://github.com/glpi-project/glpi/commit/9c29f25bd09eca9e62ca50c52b3ebd15b02997b2","https://github.com/glpi-project/glpi/releases/tag/10.0.26","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-55217","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:04:33.228230Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:05:01.467Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:29:28.418Z"}}},"related_cves":[{"value":"CVE-2026-55217","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2248,"advisory_id":"97a1f43d-4dcd-4213-af4f-377fd052274e","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53627","source_published_at":"2026-09-25T18:26:37.407+00:00","published_at":"2026-10-24T21:15:40.718665+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-53627"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Unexpected access to update operations through the API","summary":"GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API (v2) to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently enforce the applicable authorization checks. This issue is fixed in version 11.0.8.","evidence":"cve:CVE-2026-53627","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-53627","aliases":["CVE-2026-53627"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-25T19:03:35.397Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-p68f-rv24-mc54","https://github.com/glpi-project/glpi/commit/0fdd973c4bb3f203c6905a62a93512e5ca8604c0","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53627","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:03:25.690853Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:03:35.397Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:26:37.407Z"}}},"related_cves":[{"value":"CVE-2026-53627","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2247,"advisory_id":"a2e9798b-5e5d-4880-8def-c7e46223df0f","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53625","source_published_at":"2026-09-25T18:35:36.78+00:00","published_at":"2026-10-24T21:15:40.137539+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-53625"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: Privilege Escalation via authtype API manipulation","summary":"GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26.","evidence":"cve:CVE-2026-53625","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-53625","aliases":["CVE-2026-53625"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 0.70, < 10.0.26"},{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-25T19:06:26.156Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-94rp-v9f2-5rj7","https://github.com/glpi-project/glpi/commit/9329f1ecac8099b54c2ca4dd770d78f82e1e6db8","https://github.com/glpi-project/glpi/commit/eb1b4299e81abeac764902b422cf7fcd59ac85d0","https://github.com/glpi-project/glpi/releases/tag/10.0.26","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53625","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T19:06:15.761418Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:06:26.156Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:35:36.780Z"}}},"related_cves":[{"value":"CVE-2026-53625","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2246,"advisory_id":"d5cf7373-ea60-42f6-9c89-c16c4a72ea10","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-47679","source_published_at":"2026-09-25T18:33:55.668+00:00","published_at":"2026-10-24T21:15:39.50958+00:00","extraction_method":"structured","technologies":["core-cve","glpi"],"cve_ids":["CVE-2026-47679"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"GLPI: arbitrary file deletion","summary":"GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26.","evidence":"cve:CVE-2026-47679","products":[{"name":{"value":"glpi","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-47679","aliases":["CVE-2026-47679"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"glpi-project","product":"glpi","versions":[{"status":"affected","version":">= 10.0.0, < 10.0.26"},{"status":"affected","version":">= 11.0.0, < 11.0.8"}]}],"modified":"2026-09-25T19:05:50.870Z","provider":"cve","references":["https://github.com/glpi-project/glpi/security/advisories/GHSA-x5r8-r6vj-79cw","https://github.com/glpi-project/glpi/commit/54306faf6a724321ba82c53c7c07ff6612a0d832","https://github.com/glpi-project/glpi/commit/78ec583051bac3c1b3f9d21729c55cac62afa2f3","https://github.com/glpi-project/glpi/releases/tag/10.0.26","https://github.com/glpi-project/glpi/releases/tag/11.0.8"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-47679","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T19:05:42.536995Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:05:50.870Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T18:33:55.668Z"}}},"related_cves":[{"value":"CVE-2026-47679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":4094,"next_before":2246}