{"schema_version":"2","view":"grouped","data":[{"id":56155,"cve_ids":["CVE-2025-60493"],"payload":{"kind":"advisory","title":"CVE-2025-60493","summary":"A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60493","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60493","aliases":["CVE-2025-60493"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-25T00:19:25.163Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3328","https://github.com/gpac/gpac/commit/9afeea23f5c6584c02aefe1e1560c2844dfb8f7e","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/63/README.md","https://infosec.exchange/@sigdevel/117451489672249554"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/10"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-25T00:19:25.163Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:29:24.086Z"}}},"related_cves":[{"value":"CVE-2025-60493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:25aaa913-1263-4483-bbe3-2537b6473b27","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60493","advisory_id":"25aaa913-1263-4483-bbe3-2537b6473b27","event_types":["advisory"],"published_at":"2026-10-25T16:09:59.719319+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A25aaa913-1263-4483-bbe3-2537b6473b27","group":{"id":"advisory:25aaa913-1263-4483-bbe3-2537b6473b27","revision":1,"primary_event_id":55680,"change":"published","superseded_by":[],"changed":{"id":55680,"cve_ids":["CVE-2025-60493"],"payload":{"kind":"advisory","title":"CVE-2025-60493","summary":"A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60493","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60493","aliases":["CVE-2025-60493"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-25T00:19:25.163Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3328","https://github.com/gpac/gpac/commit/9afeea23f5c6584c02aefe1e1560c2844dfb8f7e","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/63/README.md","https://infosec.exchange/@sigdevel/117451489672249554"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/10"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-25T00:19:25.163Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:29:24.086Z"}}},"related_cves":[{"value":"CVE-2025-60493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:25aaa913-1263-4483-bbe3-2537b6473b27","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60493","advisory_id":"25aaa913-1263-4483-bbe3-2537b6473b27","event_types":["advisory"],"published_at":"2026-10-25T16:09:59.719319+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/55680"},"members":[{"id":55680,"cve_ids":["CVE-2025-60493"],"payload":{"kind":"advisory","title":"CVE-2025-60493","summary":"A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60493","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60493","aliases":["CVE-2025-60493"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-25T00:19:25.163Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3328","https://github.com/gpac/gpac/commit/9afeea23f5c6584c02aefe1e1560c2844dfb8f7e","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/63/README.md","https://infosec.exchange/@sigdevel/117451489672249554"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/24/10"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-25T00:19:25.163Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:29:24.086Z"}}},"related_cves":[{"value":"CVE-2025-60493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:25aaa913-1263-4483-bbe3-2537b6473b27","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60493","advisory_id":"25aaa913-1263-4483-bbe3-2537b6473b27","event_types":["advisory"],"published_at":"2026-10-25T16:09:59.719319+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/55680"}]}},{"id":53532,"cve_ids":["CVE-2025-45528"],"payload":{"kind":"advisory","title":"CVE-2025-45528","summary":"An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF","evidence":"cve:CVE-2025-45528","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-45528","aliases":["CVE-2025-45528"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:54:15.474Z","provider":"cve","references":["https://gist.github.com/momenbasel/66e33613a52f6f59e49ee8ca6ea91a61"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:54:15.474Z"}}},"related_cves":[{"value":"CVE-2025-45528","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:296d14bb-9870-4877-ab1e-b3cdbfbd48fd","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-45528","advisory_id":"296d14bb-9870-4877-ab1e-b3cdbfbd48fd","event_types":["advisory"],"published_at":"2026-10-25T14:55:16.450278+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/advisories/advisory%3A296d14bb-9870-4877-ab1e-b3cdbfbd48fd","group":{"id":"advisory:296d14bb-9870-4877-ab1e-b3cdbfbd48fd","revision":1,"primary_event_id":53061,"change":"published","superseded_by":[],"changed":{"id":53061,"cve_ids":["CVE-2025-45528"],"payload":{"kind":"advisory","title":"CVE-2025-45528","summary":"An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF","evidence":"cve:CVE-2025-45528","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-45528","aliases":["CVE-2025-45528"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:54:15.474Z","provider":"cve","references":["https://gist.github.com/momenbasel/66e33613a52f6f59e49ee8ca6ea91a61"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:54:15.474Z"}}},"related_cves":[{"value":"CVE-2025-45528","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:296d14bb-9870-4877-ab1e-b3cdbfbd48fd","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-45528","advisory_id":"296d14bb-9870-4877-ab1e-b3cdbfbd48fd","event_types":["advisory"],"published_at":"2026-10-25T14:55:16.450278+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/53061"},"members":[{"id":53061,"cve_ids":["CVE-2025-45528"],"payload":{"kind":"advisory","title":"CVE-2025-45528","summary":"An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF","evidence":"cve:CVE-2025-45528","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-45528","aliases":["CVE-2025-45528"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:54:15.474Z","provider":"cve","references":["https://gist.github.com/momenbasel/66e33613a52f6f59e49ee8ca6ea91a61"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:54:15.474Z"}}},"related_cves":[{"value":"CVE-2025-45528","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:296d14bb-9870-4877-ab1e-b3cdbfbd48fd","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-45528","advisory_id":"296d14bb-9870-4877-ab1e-b3cdbfbd48fd","event_types":["advisory"],"published_at":"2026-10-25T14:55:16.450278+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/53061"}]}},{"id":53531,"cve_ids":["CVE-2026-50787"],"payload":{"kind":"advisory","title":"CVE-2026-50787","summary":"e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.","evidence":"cve:CVE-2026-50787","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-50787","aliases":["CVE-2026-50787"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:44:11.973Z","provider":"cve","references":["https://github.com/esiclivre/esiclivre/blob/master/restrito/inc/captcha.php","https://github.com/brynax/CVE-2026-50787"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:44:11.973Z"}}},"related_cves":[{"value":"CVE-2026-50787","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e66fdca6-353b-4fc3-a052-e46fb474c15b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-50787","advisory_id":"e66fdca6-353b-4fc3-a052-e46fb474c15b","event_types":["advisory"],"published_at":"2026-10-25T14:55:15.792203+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/advisories/advisory%3Ae66fdca6-353b-4fc3-a052-e46fb474c15b","group":{"id":"advisory:e66fdca6-353b-4fc3-a052-e46fb474c15b","revision":1,"primary_event_id":53060,"change":"published","superseded_by":[],"changed":{"id":53060,"cve_ids":["CVE-2026-50787"],"payload":{"kind":"advisory","title":"CVE-2026-50787","summary":"e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.","evidence":"cve:CVE-2026-50787","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-50787","aliases":["CVE-2026-50787"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:44:11.973Z","provider":"cve","references":["https://github.com/esiclivre/esiclivre/blob/master/restrito/inc/captcha.php","https://github.com/brynax/CVE-2026-50787"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:44:11.973Z"}}},"related_cves":[{"value":"CVE-2026-50787","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e66fdca6-353b-4fc3-a052-e46fb474c15b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-50787","advisory_id":"e66fdca6-353b-4fc3-a052-e46fb474c15b","event_types":["advisory"],"published_at":"2026-10-25T14:55:15.792203+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/53060"},"members":[{"id":53060,"cve_ids":["CVE-2026-50787"],"payload":{"kind":"advisory","title":"CVE-2026-50787","summary":"e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.","evidence":"cve:CVE-2026-50787","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-50787","aliases":["CVE-2026-50787"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:44:11.973Z","provider":"cve","references":["https://github.com/esiclivre/esiclivre/blob/master/restrito/inc/captcha.php","https://github.com/brynax/CVE-2026-50787"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:44:11.973Z"}}},"related_cves":[{"value":"CVE-2026-50787","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e66fdca6-353b-4fc3-a052-e46fb474c15b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-50787","advisory_id":"e66fdca6-353b-4fc3-a052-e46fb474c15b","event_types":["advisory"],"published_at":"2026-10-25T14:55:15.792203+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/53060"}]}},{"id":53530,"cve_ids":["CVE-2026-52356"],"payload":{"kind":"advisory","title":"CVE-2026-52356","summary":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","evidence":"cve:CVE-2026-52356","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-52356","aliases":["CVE-2026-52356"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:35:09.599Z","provider":"cve","references":["https://www.dlink.com/en/security-bulletin/","https://github.com/REYu6/iot/blob/main/CVE/dlink/DAP1160LA1_FW101WWb04/DAP1160LA1_FW101WWb04_RCE.md"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:35:09.599Z"}}},"related_cves":[{"value":"CVE-2026-52356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b9e94018-7e06-4383-9576-89633ecefb23","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52356","advisory_id":"b9e94018-7e06-4383-9576-89633ecefb23","event_types":["advisory"],"published_at":"2026-10-25T14:55:15.144241+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/advisories/advisory%3Ab9e94018-7e06-4383-9576-89633ecefb23","group":{"id":"advisory:b9e94018-7e06-4383-9576-89633ecefb23","revision":1,"primary_event_id":53059,"change":"published","superseded_by":[],"changed":{"id":53059,"cve_ids":["CVE-2026-52356"],"payload":{"kind":"advisory","title":"CVE-2026-52356","summary":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","evidence":"cve:CVE-2026-52356","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-52356","aliases":["CVE-2026-52356"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:35:09.599Z","provider":"cve","references":["https://www.dlink.com/en/security-bulletin/","https://github.com/REYu6/iot/blob/main/CVE/dlink/DAP1160LA1_FW101WWb04/DAP1160LA1_FW101WWb04_RCE.md"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:35:09.599Z"}}},"related_cves":[{"value":"CVE-2026-52356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b9e94018-7e06-4383-9576-89633ecefb23","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52356","advisory_id":"b9e94018-7e06-4383-9576-89633ecefb23","event_types":["advisory"],"published_at":"2026-10-25T14:55:15.144241+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/53059"},"members":[{"id":53059,"cve_ids":["CVE-2026-52356"],"payload":{"kind":"advisory","title":"CVE-2026-52356","summary":"An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.","evidence":"cve:CVE-2026-52356","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-52356","aliases":["CVE-2026-52356"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:35:09.599Z","provider":"cve","references":["https://www.dlink.com/en/security-bulletin/","https://github.com/REYu6/iot/blob/main/CVE/dlink/DAP1160LA1_FW101WWb04/DAP1160LA1_FW101WWb04_RCE.md"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T15:35:09.599Z"}}},"related_cves":[{"value":"CVE-2026-52356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b9e94018-7e06-4383-9576-89633ecefb23","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52356","advisory_id":"b9e94018-7e06-4383-9576-89633ecefb23","event_types":["advisory"],"published_at":"2026-10-25T14:55:15.144241+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/53059"}]}},{"id":53474,"cve_ids":["CVE-2025-60497"],"payload":{"kind":"advisory","title":"CVE-2025-60497","summary":"A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60497","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60497","aliases":["CVE-2025-60497"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:33.099Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3336","https://github.com/gpac/gpac/commit/91083fcfce01aa596a13a6962768d13a60bfc8bb","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/62/README.md","https://infosec.exchange/@sigdevel/117451504006040011"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-60497","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T19:08:00.691437Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3336","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:13:34.505Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/19"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:33.099Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:23:52.286Z"}}},"related_cves":[{"value":"CVE-2025-60497","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:288a1dbc-553a-4997-8f29-3d566c843f28","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60497","advisory_id":"288a1dbc-553a-4997-8f29-3d566c843f28","event_types":["advisory"],"published_at":"2026-10-25T14:54:35.065116+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A288a1dbc-553a-4997-8f29-3d566c843f28","group":{"id":"advisory:288a1dbc-553a-4997-8f29-3d566c843f28","revision":1,"primary_event_id":53003,"change":"published","superseded_by":[],"changed":{"id":53003,"cve_ids":["CVE-2025-60497"],"payload":{"kind":"advisory","title":"CVE-2025-60497","summary":"A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60497","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60497","aliases":["CVE-2025-60497"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:33.099Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3336","https://github.com/gpac/gpac/commit/91083fcfce01aa596a13a6962768d13a60bfc8bb","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/62/README.md","https://infosec.exchange/@sigdevel/117451504006040011"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-60497","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T19:08:00.691437Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3336","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:13:34.505Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/19"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:33.099Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:23:52.286Z"}}},"related_cves":[{"value":"CVE-2025-60497","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:288a1dbc-553a-4997-8f29-3d566c843f28","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60497","advisory_id":"288a1dbc-553a-4997-8f29-3d566c843f28","event_types":["advisory"],"published_at":"2026-10-25T14:54:35.065116+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/53003"},"members":[{"id":53003,"cve_ids":["CVE-2025-60497"],"payload":{"kind":"advisory","title":"CVE-2025-60497","summary":"A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60497","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60497","aliases":["CVE-2025-60497"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:33.099Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3336","https://github.com/gpac/gpac/commit/91083fcfce01aa596a13a6962768d13a60bfc8bb","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/62/README.md","https://infosec.exchange/@sigdevel/117451504006040011"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-60497","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T19:08:00.691437Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3336","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:13:34.505Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/19"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:33.099Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:23:52.286Z"}}},"related_cves":[{"value":"CVE-2025-60497","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:288a1dbc-553a-4997-8f29-3d566c843f28","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60497","advisory_id":"288a1dbc-553a-4997-8f29-3d566c843f28","event_types":["advisory"],"published_at":"2026-10-25T14:54:35.065116+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/53003"}]}},{"id":53473,"cve_ids":["CVE-2025-60494"],"payload":{"kind":"advisory","title":"CVE-2025-60494","summary":"A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.","evidence":"cve:CVE-2025-60494","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60494","aliases":["CVE-2025-60494"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:31.989Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3329","https://github.com/gpac/gpac/commit/fcb9083292befe61d3e2466b18edfedba49da098","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/64/README.md","https://infosec.exchange/@sigdevel/117451480059519560"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/18"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:31.989Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T21:18:31.244Z"}}},"related_cves":[{"value":"CVE-2025-60494","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6b42c3e9-6a39-405b-afef-cf076b510642","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60494","advisory_id":"6b42c3e9-6a39-405b-afef-cf076b510642","event_types":["advisory"],"published_at":"2026-10-25T14:54:34.301001+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/advisories/advisory%3A6b42c3e9-6a39-405b-afef-cf076b510642","group":{"id":"advisory:6b42c3e9-6a39-405b-afef-cf076b510642","revision":1,"primary_event_id":53002,"change":"published","superseded_by":[],"changed":{"id":53002,"cve_ids":["CVE-2025-60494"],"payload":{"kind":"advisory","title":"CVE-2025-60494","summary":"A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.","evidence":"cve:CVE-2025-60494","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60494","aliases":["CVE-2025-60494"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:31.989Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3329","https://github.com/gpac/gpac/commit/fcb9083292befe61d3e2466b18edfedba49da098","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/64/README.md","https://infosec.exchange/@sigdevel/117451480059519560"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/18"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:31.989Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T21:18:31.244Z"}}},"related_cves":[{"value":"CVE-2025-60494","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6b42c3e9-6a39-405b-afef-cf076b510642","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60494","advisory_id":"6b42c3e9-6a39-405b-afef-cf076b510642","event_types":["advisory"],"published_at":"2026-10-25T14:54:34.301001+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/events/53002"},"members":[{"id":53002,"cve_ids":["CVE-2025-60494"],"payload":{"kind":"advisory","title":"CVE-2025-60494","summary":"A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.","evidence":"cve:CVE-2025-60494","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60494","aliases":["CVE-2025-60494"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:31.989Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3329","https://github.com/gpac/gpac/commit/fcb9083292befe61d3e2466b18edfedba49da098","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/64/README.md","https://infosec.exchange/@sigdevel/117451480059519560"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/18"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:31.989Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T21:18:31.244Z"}}},"related_cves":[{"value":"CVE-2025-60494","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6b42c3e9-6a39-405b-afef-cf076b510642","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60494","advisory_id":"6b42c3e9-6a39-405b-afef-cf076b510642","event_types":["advisory"],"published_at":"2026-10-25T14:54:34.301001+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/events/53002"}]}},{"id":53472,"cve_ids":["CVE-2025-60492"],"payload":{"kind":"advisory","title":"CVE-2025-60492","summary":"A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60492","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60492","aliases":["CVE-2025-60492"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:30.908Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3324","https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/README.md","https://infosec.exchange/@sigdevel/117456655329648201"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-60492","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T19:04:59.963631Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3324","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-121","description":"CWE-121 Stack-based Buffer Overflow"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:05:36.157Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/17"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:30.908Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:36:30.577Z"}}},"related_cves":[{"value":"CVE-2025-60492","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:35dbee46-6746-49b4-9a4f-dbdc8667d992","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60492","advisory_id":"35dbee46-6746-49b4-9a4f-dbdc8667d992","event_types":["advisory"],"published_at":"2026-10-25T14:54:33.219293+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A35dbee46-6746-49b4-9a4f-dbdc8667d992","group":{"id":"advisory:35dbee46-6746-49b4-9a4f-dbdc8667d992","revision":1,"primary_event_id":53001,"change":"published","superseded_by":[],"changed":{"id":53001,"cve_ids":["CVE-2025-60492"],"payload":{"kind":"advisory","title":"CVE-2025-60492","summary":"A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60492","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60492","aliases":["CVE-2025-60492"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:30.908Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3324","https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/README.md","https://infosec.exchange/@sigdevel/117456655329648201"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-60492","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T19:04:59.963631Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3324","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-121","description":"CWE-121 Stack-based Buffer Overflow"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:05:36.157Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/17"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:30.908Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:36:30.577Z"}}},"related_cves":[{"value":"CVE-2025-60492","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:35dbee46-6746-49b4-9a4f-dbdc8667d992","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60492","advisory_id":"35dbee46-6746-49b4-9a4f-dbdc8667d992","event_types":["advisory"],"published_at":"2026-10-25T14:54:33.219293+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/53001"},"members":[{"id":53001,"cve_ids":["CVE-2025-60492"],"payload":{"kind":"advisory","title":"CVE-2025-60492","summary":"A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60492","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60492","aliases":["CVE-2025-60492"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:30.908Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3324","https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/README.md","https://infosec.exchange/@sigdevel/117456655329648201"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-60492","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T19:04:59.963631Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3324","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-121","description":"CWE-121 Stack-based Buffer Overflow"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:05:36.157Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/17"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:30.908Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:36:30.577Z"}}},"related_cves":[{"value":"CVE-2025-60492","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:35dbee46-6746-49b4-9a4f-dbdc8667d992","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60492","advisory_id":"35dbee46-6746-49b4-9a4f-dbdc8667d992","event_types":["advisory"],"published_at":"2026-10-25T14:54:33.219293+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/53001"}]}},{"id":53471,"cve_ids":["CVE-2025-60491"],"payload":{"kind":"advisory","title":"CVE-2025-60491","summary":"A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60491","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60491","aliases":["CVE-2025-60491"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:29.849Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3326","https://github.com/gpac/gpac/commit/f6128214feb69cd689e4b9944a2621bc4ad8faf0","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/61/README.md","https://infosec.exchange/@sigdevel/117451513352278768"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/16"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:29.849Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:16:00.697Z"}}},"related_cves":[{"value":"CVE-2025-60491","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6944aab7-ceb5-4816-abdc-278d28c39c66","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60491","advisory_id":"6944aab7-ceb5-4816-abdc-278d28c39c66","event_types":["advisory"],"published_at":"2026-10-25T14:54:32.595582+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A6944aab7-ceb5-4816-abdc-278d28c39c66","group":{"id":"advisory:6944aab7-ceb5-4816-abdc-278d28c39c66","revision":1,"primary_event_id":53000,"change":"published","superseded_by":[],"changed":{"id":53000,"cve_ids":["CVE-2025-60491"],"payload":{"kind":"advisory","title":"CVE-2025-60491","summary":"A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60491","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60491","aliases":["CVE-2025-60491"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:29.849Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3326","https://github.com/gpac/gpac/commit/f6128214feb69cd689e4b9944a2621bc4ad8faf0","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/61/README.md","https://infosec.exchange/@sigdevel/117451513352278768"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/16"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:29.849Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:16:00.697Z"}}},"related_cves":[{"value":"CVE-2025-60491","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6944aab7-ceb5-4816-abdc-278d28c39c66","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60491","advisory_id":"6944aab7-ceb5-4816-abdc-278d28c39c66","event_types":["advisory"],"published_at":"2026-10-25T14:54:32.595582+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/53000"},"members":[{"id":53000,"cve_ids":["CVE-2025-60491"],"payload":{"kind":"advisory","title":"CVE-2025-60491","summary":"A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60491","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60491","aliases":["CVE-2025-60491"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:29.849Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3326","https://github.com/gpac/gpac/commit/f6128214feb69cd689e4b9944a2621bc4ad8faf0","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/61/README.md","https://infosec.exchange/@sigdevel/117451513352278768"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/16"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:29.849Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:16:00.697Z"}}},"related_cves":[{"value":"CVE-2025-60491","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:6944aab7-ceb5-4816-abdc-278d28c39c66","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60491","advisory_id":"6944aab7-ceb5-4816-abdc-278d28c39c66","event_types":["advisory"],"published_at":"2026-10-25T14:54:32.595582+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/53000"}]}},{"id":53470,"cve_ids":["CVE-2025-60490"],"payload":{"kind":"advisory","title":"CVE-2025-60490","summary":"A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60490","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60490","aliases":["CVE-2025-60490"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:28.748Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3315","https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/README.md","https://infosec.exchange/@sigdevel/117456620287496398"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/15"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:28.748Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:40:40.918Z"}}},"related_cves":[{"value":"CVE-2025-60490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f0bb726b-1907-466a-8695-5f3da4c2d43f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60490","advisory_id":"f0bb726b-1907-466a-8695-5f3da4c2d43f","event_types":["advisory"],"published_at":"2026-10-25T14:54:31.964638+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3Af0bb726b-1907-466a-8695-5f3da4c2d43f","group":{"id":"advisory:f0bb726b-1907-466a-8695-5f3da4c2d43f","revision":1,"primary_event_id":52999,"change":"published","superseded_by":[],"changed":{"id":52999,"cve_ids":["CVE-2025-60490"],"payload":{"kind":"advisory","title":"CVE-2025-60490","summary":"A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60490","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60490","aliases":["CVE-2025-60490"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:28.748Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3315","https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/README.md","https://infosec.exchange/@sigdevel/117456620287496398"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/15"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:28.748Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:40:40.918Z"}}},"related_cves":[{"value":"CVE-2025-60490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f0bb726b-1907-466a-8695-5f3da4c2d43f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60490","advisory_id":"f0bb726b-1907-466a-8695-5f3da4c2d43f","event_types":["advisory"],"published_at":"2026-10-25T14:54:31.964638+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52999"},"members":[{"id":52999,"cve_ids":["CVE-2025-60490"],"payload":{"kind":"advisory","title":"CVE-2025-60490","summary":"A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60490","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60490","aliases":["CVE-2025-60490"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:28.748Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3315","https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/README.md","https://infosec.exchange/@sigdevel/117456620287496398"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/15"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:28.748Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:40:40.918Z"}}},"related_cves":[{"value":"CVE-2025-60490","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f0bb726b-1907-466a-8695-5f3da4c2d43f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60490","advisory_id":"f0bb726b-1907-466a-8695-5f3da4c2d43f","event_types":["advisory"],"published_at":"2026-10-25T14:54:31.964638+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52999"}]}},{"id":53469,"cve_ids":["CVE-2025-60489"],"payload":{"kind":"advisory","title":"CVE-2025-60489","summary":"A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60489","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60489","aliases":["CVE-2025-60489"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:27.683Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/4860a1a6f128ccc9ae37b4b738d22029f9672457","https://github.com/gpac/gpac/issues/3325","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/60/README.md","https://infosec.exchange/@sigdevel/117451521960820132"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/14"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:27.683Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:53:57.572Z"}}},"related_cves":[{"value":"CVE-2025-60489","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84fabc2e-7b04-437d-bed1-4f8a1f9de6e7","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60489","advisory_id":"84fabc2e-7b04-437d-bed1-4f8a1f9de6e7","event_types":["advisory"],"published_at":"2026-10-25T14:54:31.339102+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A84fabc2e-7b04-437d-bed1-4f8a1f9de6e7","group":{"id":"advisory:84fabc2e-7b04-437d-bed1-4f8a1f9de6e7","revision":1,"primary_event_id":52998,"change":"published","superseded_by":[],"changed":{"id":52998,"cve_ids":["CVE-2025-60489"],"payload":{"kind":"advisory","title":"CVE-2025-60489","summary":"A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60489","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60489","aliases":["CVE-2025-60489"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:27.683Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/4860a1a6f128ccc9ae37b4b738d22029f9672457","https://github.com/gpac/gpac/issues/3325","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/60/README.md","https://infosec.exchange/@sigdevel/117451521960820132"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/14"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:27.683Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:53:57.572Z"}}},"related_cves":[{"value":"CVE-2025-60489","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84fabc2e-7b04-437d-bed1-4f8a1f9de6e7","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60489","advisory_id":"84fabc2e-7b04-437d-bed1-4f8a1f9de6e7","event_types":["advisory"],"published_at":"2026-10-25T14:54:31.339102+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52998"},"members":[{"id":52998,"cve_ids":["CVE-2025-60489"],"payload":{"kind":"advisory","title":"CVE-2025-60489","summary":"A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60489","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60489","aliases":["CVE-2025-60489"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:27.683Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/4860a1a6f128ccc9ae37b4b738d22029f9672457","https://github.com/gpac/gpac/issues/3325","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/60/README.md","https://infosec.exchange/@sigdevel/117451521960820132"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/14"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:27.683Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:53:57.572Z"}}},"related_cves":[{"value":"CVE-2025-60489","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84fabc2e-7b04-437d-bed1-4f8a1f9de6e7","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60489","advisory_id":"84fabc2e-7b04-437d-bed1-4f8a1f9de6e7","event_types":["advisory"],"published_at":"2026-10-25T14:54:31.339102+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52998"}]}},{"id":53468,"cve_ids":["CVE-2025-60487"],"payload":{"kind":"advisory","title":"CVE-2025-60487","summary":"A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.","evidence":"cve:CVE-2025-60487","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60487","aliases":["CVE-2025-60487"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:26.577Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","https://github.com/gpac/gpac/issues/3320","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/56/README.md","https://infosec.exchange/@sigdevel/117456633862790827"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/13"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:26.577Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:38:32.720Z"}}},"related_cves":[{"value":"CVE-2025-60487","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07f3b658-496a-4d75-bd4e-998314db7dfc","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60487","advisory_id":"07f3b658-496a-4d75-bd4e-998314db7dfc","event_types":["advisory"],"published_at":"2026-10-25T14:54:30.671732+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A07f3b658-496a-4d75-bd4e-998314db7dfc","group":{"id":"advisory:07f3b658-496a-4d75-bd4e-998314db7dfc","revision":1,"primary_event_id":52997,"change":"published","superseded_by":[],"changed":{"id":52997,"cve_ids":["CVE-2025-60487"],"payload":{"kind":"advisory","title":"CVE-2025-60487","summary":"A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.","evidence":"cve:CVE-2025-60487","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60487","aliases":["CVE-2025-60487"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:26.577Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","https://github.com/gpac/gpac/issues/3320","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/56/README.md","https://infosec.exchange/@sigdevel/117456633862790827"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/13"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:26.577Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:38:32.720Z"}}},"related_cves":[{"value":"CVE-2025-60487","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07f3b658-496a-4d75-bd4e-998314db7dfc","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60487","advisory_id":"07f3b658-496a-4d75-bd4e-998314db7dfc","event_types":["advisory"],"published_at":"2026-10-25T14:54:30.671732+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52997"},"members":[{"id":52997,"cve_ids":["CVE-2025-60487"],"payload":{"kind":"advisory","title":"CVE-2025-60487","summary":"A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.","evidence":"cve:CVE-2025-60487","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60487","aliases":["CVE-2025-60487"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T15:07:26.577Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","https://github.com/gpac/gpac/issues/3320","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/56/README.md","https://infosec.exchange/@sigdevel/117456633862790827"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/13"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-23T15:07:26.577Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:38:32.720Z"}}},"related_cves":[{"value":"CVE-2025-60487","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:07f3b658-496a-4d75-bd4e-998314db7dfc","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60487","advisory_id":"07f3b658-496a-4d75-bd4e-998314db7dfc","event_types":["advisory"],"published_at":"2026-10-25T14:54:30.671732+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52997"}]}},{"id":53458,"cve_ids":["CVE-2026-106765"],"payload":{"kind":"advisory","title":"CVE-2026-106765","summary":"An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.","evidence":"cve:CVE-2026-106765","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106765","aliases":["CVE-2026-106765"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:57:04.297Z","provider":"cve","references":["https://github.com/rog0x/mcp-git-tools/issues/1","https://stillosdigitalholdings.com/advisories/CVE-2026-106765.cve.json","https://www.npmjs.com/package/@rog0x/mcp-docker-tools"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:57:04.297Z"}}},"related_cves":[{"value":"CVE-2026-106765","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:22994a78-a759-482c-a510-d44871f837ca","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106765","advisory_id":"22994a78-a759-482c-a510-d44871f837ca","event_types":["advisory"],"published_at":"2026-10-25T14:54:23.984567+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/advisories/advisory%3A22994a78-a759-482c-a510-d44871f837ca","group":{"id":"advisory:22994a78-a759-482c-a510-d44871f837ca","revision":1,"primary_event_id":52987,"change":"published","superseded_by":[],"changed":{"id":52987,"cve_ids":["CVE-2026-106765"],"payload":{"kind":"advisory","title":"CVE-2026-106765","summary":"An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.","evidence":"cve:CVE-2026-106765","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106765","aliases":["CVE-2026-106765"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:57:04.297Z","provider":"cve","references":["https://github.com/rog0x/mcp-git-tools/issues/1","https://stillosdigitalholdings.com/advisories/CVE-2026-106765.cve.json","https://www.npmjs.com/package/@rog0x/mcp-docker-tools"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:57:04.297Z"}}},"related_cves":[{"value":"CVE-2026-106765","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:22994a78-a759-482c-a510-d44871f837ca","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106765","advisory_id":"22994a78-a759-482c-a510-d44871f837ca","event_types":["advisory"],"published_at":"2026-10-25T14:54:23.984567+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/52987"},"members":[{"id":52987,"cve_ids":["CVE-2026-106765"],"payload":{"kind":"advisory","title":"CVE-2026-106765","summary":"An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.","evidence":"cve:CVE-2026-106765","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106765","aliases":["CVE-2026-106765"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:57:04.297Z","provider":"cve","references":["https://github.com/rog0x/mcp-git-tools/issues/1","https://stillosdigitalholdings.com/advisories/CVE-2026-106765.cve.json","https://www.npmjs.com/package/@rog0x/mcp-docker-tools"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:57:04.297Z"}}},"related_cves":[{"value":"CVE-2026-106765","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:22994a78-a759-482c-a510-d44871f837ca","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106765","advisory_id":"22994a78-a759-482c-a510-d44871f837ca","event_types":["advisory"],"published_at":"2026-10-25T14:54:23.984567+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/52987"}]}},{"id":53453,"cve_ids":["CVE-2026-106764"],"payload":{"kind":"advisory","title":"CVE-2026-106764","summary":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","evidence":"cve:CVE-2026-106764","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106764","aliases":["CVE-2026-106764"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:47:05.293Z","provider":"cve","references":["https://www.npmjs.com/package/@rog0x/mcp-git-tools","https://github.com/rog0x/mcp-git-tools/issues/1","https://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:47:05.293Z"}}},"related_cves":[{"value":"CVE-2026-106764","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bc200639-3d26-4b27-951f-a91059ea6e4f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106764","advisory_id":"bc200639-3d26-4b27-951f-a91059ea6e4f","event_types":["advisory"],"published_at":"2026-10-25T14:54:20.480226+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/advisories/advisory%3Abc200639-3d26-4b27-951f-a91059ea6e4f","group":{"id":"advisory:bc200639-3d26-4b27-951f-a91059ea6e4f","revision":1,"primary_event_id":52982,"change":"published","superseded_by":[],"changed":{"id":52982,"cve_ids":["CVE-2026-106764"],"payload":{"kind":"advisory","title":"CVE-2026-106764","summary":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","evidence":"cve:CVE-2026-106764","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106764","aliases":["CVE-2026-106764"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:47:05.293Z","provider":"cve","references":["https://www.npmjs.com/package/@rog0x/mcp-git-tools","https://github.com/rog0x/mcp-git-tools/issues/1","https://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:47:05.293Z"}}},"related_cves":[{"value":"CVE-2026-106764","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bc200639-3d26-4b27-951f-a91059ea6e4f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106764","advisory_id":"bc200639-3d26-4b27-951f-a91059ea6e4f","event_types":["advisory"],"published_at":"2026-10-25T14:54:20.480226+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/52982"},"members":[{"id":52982,"cve_ids":["CVE-2026-106764"],"payload":{"kind":"advisory","title":"CVE-2026-106764","summary":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","evidence":"cve:CVE-2026-106764","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106764","aliases":["CVE-2026-106764"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:47:05.293Z","provider":"cve","references":["https://www.npmjs.com/package/@rog0x/mcp-git-tools","https://github.com/rog0x/mcp-git-tools/issues/1","https://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:47:05.293Z"}}},"related_cves":[{"value":"CVE-2026-106764","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bc200639-3d26-4b27-951f-a91059ea6e4f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106764","advisory_id":"bc200639-3d26-4b27-951f-a91059ea6e4f","event_types":["advisory"],"published_at":"2026-10-25T14:54:20.480226+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/52982"}]}},{"id":53452,"cve_ids":["CVE-2026-106763"],"payload":{"kind":"advisory","title":"CVE-2026-106763","summary":"An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.","evidence":"cve:CVE-2026-106763","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106763","aliases":["CVE-2026-106763"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:45:39.204Z","provider":"cve","references":["https://github.com/justice8096/sagemath-mcp-server/issues/1","https://www.npmjs.com/package/@justice8096/sagemath-mcp-server","https://stillosdigitalholdings.com/advisories/CVE-2026-106763.cve.json"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:45:39.204Z"}}},"related_cves":[{"value":"CVE-2026-106763","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:74ca5cf9-4fe8-4826-9bcb-482783319313","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106763","advisory_id":"74ca5cf9-4fe8-4826-9bcb-482783319313","event_types":["advisory"],"published_at":"2026-10-25T14:54:19.456149+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/advisories/advisory%3A74ca5cf9-4fe8-4826-9bcb-482783319313","group":{"id":"advisory:74ca5cf9-4fe8-4826-9bcb-482783319313","revision":1,"primary_event_id":52981,"change":"published","superseded_by":[],"changed":{"id":52981,"cve_ids":["CVE-2026-106763"],"payload":{"kind":"advisory","title":"CVE-2026-106763","summary":"An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.","evidence":"cve:CVE-2026-106763","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106763","aliases":["CVE-2026-106763"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:45:39.204Z","provider":"cve","references":["https://github.com/justice8096/sagemath-mcp-server/issues/1","https://www.npmjs.com/package/@justice8096/sagemath-mcp-server","https://stillosdigitalholdings.com/advisories/CVE-2026-106763.cve.json"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:45:39.204Z"}}},"related_cves":[{"value":"CVE-2026-106763","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:74ca5cf9-4fe8-4826-9bcb-482783319313","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106763","advisory_id":"74ca5cf9-4fe8-4826-9bcb-482783319313","event_types":["advisory"],"published_at":"2026-10-25T14:54:19.456149+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/52981"},"members":[{"id":52981,"cve_ids":["CVE-2026-106763"],"payload":{"kind":"advisory","title":"CVE-2026-106763","summary":"An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.","evidence":"cve:CVE-2026-106763","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-106763","aliases":["CVE-2026-106763"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-23T14:45:39.204Z","provider":"cve","references":["https://github.com/justice8096/sagemath-mcp-server/issues/1","https://www.npmjs.com/package/@justice8096/sagemath-mcp-server","https://stillosdigitalholdings.com/advisories/CVE-2026-106763.cve.json"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-23T14:45:39.204Z"}}},"related_cves":[{"value":"CVE-2026-106763","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:74ca5cf9-4fe8-4826-9bcb-482783319313","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106763","advisory_id":"74ca5cf9-4fe8-4826-9bcb-482783319313","event_types":["advisory"],"published_at":"2026-10-25T14:54:19.456149+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-23T00:00:00+00:00","detail_url":"/events/52981"}]}},{"id":52880,"cve_ids":["CVE-2025-71438"],"payload":{"kind":"advisory","title":"CVE-2025-71438","summary":"An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-71438","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-71438","aliases":["CVE-2025-71438"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:10.145Z","provider":"cve","references":["https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/50/50_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2179","https://github.com/gpac/gpac/issues/3303","https://github.com/gpac/gpac/commit/13eb5b76560aaf7813b865a2ad433258478e2695"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/26"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:10.145Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:55:36.044Z"}}},"related_cves":[{"value":"CVE-2025-71438","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:da63d328-331d-4a55-a8be-694e67f463c6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-71438","advisory_id":"da63d328-331d-4a55-a8be-694e67f463c6","event_types":["advisory"],"published_at":"2026-10-25T14:44:21.684026+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3Ada63d328-331d-4a55-a8be-694e67f463c6","group":{"id":"advisory:da63d328-331d-4a55-a8be-694e67f463c6","revision":1,"primary_event_id":52408,"change":"published","superseded_by":[],"changed":{"id":52408,"cve_ids":["CVE-2025-71438"],"payload":{"kind":"advisory","title":"CVE-2025-71438","summary":"An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-71438","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-71438","aliases":["CVE-2025-71438"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:10.145Z","provider":"cve","references":["https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/50/50_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2179","https://github.com/gpac/gpac/issues/3303","https://github.com/gpac/gpac/commit/13eb5b76560aaf7813b865a2ad433258478e2695"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/26"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:10.145Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:55:36.044Z"}}},"related_cves":[{"value":"CVE-2025-71438","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:da63d328-331d-4a55-a8be-694e67f463c6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-71438","advisory_id":"da63d328-331d-4a55-a8be-694e67f463c6","event_types":["advisory"],"published_at":"2026-10-25T14:44:21.684026+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52408"},"members":[{"id":52408,"cve_ids":["CVE-2025-71438"],"payload":{"kind":"advisory","title":"CVE-2025-71438","summary":"An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-71438","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-71438","aliases":["CVE-2025-71438"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:10.145Z","provider":"cve","references":["https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/50/50_gf_odf_ac4_cfg_dsi_v1_odf_descriptors_c_2179","https://github.com/gpac/gpac/issues/3303","https://github.com/gpac/gpac/commit/13eb5b76560aaf7813b865a2ad433258478e2695"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/26"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:10.145Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:55:36.044Z"}}},"related_cves":[{"value":"CVE-2025-71438","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:da63d328-331d-4a55-a8be-694e67f463c6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-71438","advisory_id":"da63d328-331d-4a55-a8be-694e67f463c6","event_types":["advisory"],"published_at":"2026-10-25T14:44:21.684026+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52408"}]}},{"id":52879,"cve_ids":["CVE-2025-60496"],"payload":{"kind":"advisory","title":"CVE-2025-60496","summary":"A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60496","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60496","aliases":["CVE-2025-60496"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:09.027Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3334","https://github.com/gpac/gpac/commit/f03c946aae129980f0426d4cbae9746d0536fee6","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/65/README.md","https://infosec.exchange/@sigdevel/117451461416101711"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/25"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:09.027Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T21:13:28.831Z"}}},"related_cves":[{"value":"CVE-2025-60496","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cc692111-eec0-4e9e-808f-fdb5403f70d0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60496","advisory_id":"cc692111-eec0-4e9e-808f-fdb5403f70d0","event_types":["advisory"],"published_at":"2026-10-25T14:44:21.028227+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/advisories/advisory%3Acc692111-eec0-4e9e-808f-fdb5403f70d0","group":{"id":"advisory:cc692111-eec0-4e9e-808f-fdb5403f70d0","revision":1,"primary_event_id":52407,"change":"published","superseded_by":[],"changed":{"id":52407,"cve_ids":["CVE-2025-60496"],"payload":{"kind":"advisory","title":"CVE-2025-60496","summary":"A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60496","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60496","aliases":["CVE-2025-60496"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:09.027Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3334","https://github.com/gpac/gpac/commit/f03c946aae129980f0426d4cbae9746d0536fee6","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/65/README.md","https://infosec.exchange/@sigdevel/117451461416101711"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/25"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:09.027Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T21:13:28.831Z"}}},"related_cves":[{"value":"CVE-2025-60496","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cc692111-eec0-4e9e-808f-fdb5403f70d0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60496","advisory_id":"cc692111-eec0-4e9e-808f-fdb5403f70d0","event_types":["advisory"],"published_at":"2026-10-25T14:44:21.028227+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/events/52407"},"members":[{"id":52407,"cve_ids":["CVE-2025-60496"],"payload":{"kind":"advisory","title":"CVE-2025-60496","summary":"A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","evidence":"cve:CVE-2025-60496","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60496","aliases":["CVE-2025-60496"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:09.027Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3334","https://github.com/gpac/gpac/commit/f03c946aae129980f0426d4cbae9746d0536fee6","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/65/README.md","https://infosec.exchange/@sigdevel/117451461416101711"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/25"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:09.027Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T21:13:28.831Z"}}},"related_cves":[{"value":"CVE-2025-60496","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:cc692111-eec0-4e9e-808f-fdb5403f70d0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60496","advisory_id":"cc692111-eec0-4e9e-808f-fdb5403f70d0","event_types":["advisory"],"published_at":"2026-10-25T14:44:21.028227+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/events/52407"}]}},{"id":52878,"cve_ids":["CVE-2025-60479"],"payload":{"kind":"advisory","title":"CVE-2025-60479","summary":"A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.","evidence":"cve:CVE-2025-60479","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60479","aliases":["CVE-2025-60479"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:07.907Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3322","https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/58/README.md","https://infosec.exchange/@sigdevel/117451528497213210"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/24"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:07.907Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:50:28.276Z"}}},"related_cves":[{"value":"CVE-2025-60479","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44a695b3-88c2-4f56-b46b-b2981ebb3fd2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60479","advisory_id":"44a695b3-88c2-4f56-b46b-b2981ebb3fd2","event_types":["advisory"],"published_at":"2026-10-25T14:44:20.33012+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A44a695b3-88c2-4f56-b46b-b2981ebb3fd2","group":{"id":"advisory:44a695b3-88c2-4f56-b46b-b2981ebb3fd2","revision":1,"primary_event_id":52406,"change":"published","superseded_by":[],"changed":{"id":52406,"cve_ids":["CVE-2025-60479"],"payload":{"kind":"advisory","title":"CVE-2025-60479","summary":"A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.","evidence":"cve:CVE-2025-60479","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60479","aliases":["CVE-2025-60479"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:07.907Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3322","https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/58/README.md","https://infosec.exchange/@sigdevel/117451528497213210"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/24"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:07.907Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:50:28.276Z"}}},"related_cves":[{"value":"CVE-2025-60479","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44a695b3-88c2-4f56-b46b-b2981ebb3fd2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60479","advisory_id":"44a695b3-88c2-4f56-b46b-b2981ebb3fd2","event_types":["advisory"],"published_at":"2026-10-25T14:44:20.33012+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52406"},"members":[{"id":52406,"cve_ids":["CVE-2025-60479"],"payload":{"kind":"advisory","title":"CVE-2025-60479","summary":"A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.","evidence":"cve:CVE-2025-60479","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60479","aliases":["CVE-2025-60479"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:07.907Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3322","https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/58/README.md","https://infosec.exchange/@sigdevel/117451528497213210"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/24"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:07.907Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T13:50:28.276Z"}}},"related_cves":[{"value":"CVE-2025-60479","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44a695b3-88c2-4f56-b46b-b2981ebb3fd2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60479","advisory_id":"44a695b3-88c2-4f56-b46b-b2981ebb3fd2","event_types":["advisory"],"published_at":"2026-10-25T14:44:20.33012+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52406"}]}},{"id":52877,"cve_ids":["CVE-2025-60476"],"payload":{"kind":"advisory","title":"CVE-2025-60476","summary":"A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-60476","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60476","aliases":["CVE-2025-60476"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:05.617Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b","https://github.com/gpac/gpac/issues/3293","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/42/README.md","https://infosec.exchange/@sigdevel/117456471347684902"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/22"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:05.617Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T15:07:20.622Z"}}},"related_cves":[{"value":"CVE-2025-60476","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d4bf7dda-0ee4-49a5-a47c-95981278049f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60476","advisory_id":"d4bf7dda-0ee4-49a5-a47c-95981278049f","event_types":["advisory"],"published_at":"2026-10-25T14:44:19.585739+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3Ad4bf7dda-0ee4-49a5-a47c-95981278049f","group":{"id":"advisory:d4bf7dda-0ee4-49a5-a47c-95981278049f","revision":1,"primary_event_id":52405,"change":"published","superseded_by":[],"changed":{"id":52405,"cve_ids":["CVE-2025-60476"],"payload":{"kind":"advisory","title":"CVE-2025-60476","summary":"A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-60476","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60476","aliases":["CVE-2025-60476"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:05.617Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b","https://github.com/gpac/gpac/issues/3293","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/42/README.md","https://infosec.exchange/@sigdevel/117456471347684902"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/22"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:05.617Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T15:07:20.622Z"}}},"related_cves":[{"value":"CVE-2025-60476","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d4bf7dda-0ee4-49a5-a47c-95981278049f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60476","advisory_id":"d4bf7dda-0ee4-49a5-a47c-95981278049f","event_types":["advisory"],"published_at":"2026-10-25T14:44:19.585739+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52405"},"members":[{"id":52405,"cve_ids":["CVE-2025-60476"],"payload":{"kind":"advisory","title":"CVE-2025-60476","summary":"A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-60476","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60476","aliases":["CVE-2025-60476"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:05.617Z","provider":"cve","references":["https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b","https://github.com/gpac/gpac/issues/3293","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/42/README.md","https://infosec.exchange/@sigdevel/117456471347684902"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/22"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:05.617Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T15:07:20.622Z"}}},"related_cves":[{"value":"CVE-2025-60476","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d4bf7dda-0ee4-49a5-a47c-95981278049f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60476","advisory_id":"d4bf7dda-0ee4-49a5-a47c-95981278049f","event_types":["advisory"],"published_at":"2026-10-25T14:44:19.585739+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52405"}]}},{"id":52876,"cve_ids":["CVE-2025-60478"],"payload":{"kind":"advisory","title":"CVE-2025-60478","summary":"A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.","evidence":"cve:CVE-2025-60478","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60478","aliases":["CVE-2025-60478"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:06.764Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3300","https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/README.md","https://infosec.exchange/@sigdevel/117456560052551246"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/23"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:06.764Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:45:47.287Z"}}},"related_cves":[{"value":"CVE-2025-60478","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:eae1eeac-ff0f-43ac-9659-ad1bbc945ce2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60478","advisory_id":"eae1eeac-ff0f-43ac-9659-ad1bbc945ce2","event_types":["advisory"],"published_at":"2026-10-25T14:44:18.907499+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3Aeae1eeac-ff0f-43ac-9659-ad1bbc945ce2","group":{"id":"advisory:eae1eeac-ff0f-43ac-9659-ad1bbc945ce2","revision":1,"primary_event_id":52404,"change":"published","superseded_by":[],"changed":{"id":52404,"cve_ids":["CVE-2025-60478"],"payload":{"kind":"advisory","title":"CVE-2025-60478","summary":"A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.","evidence":"cve:CVE-2025-60478","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60478","aliases":["CVE-2025-60478"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:06.764Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3300","https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/README.md","https://infosec.exchange/@sigdevel/117456560052551246"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/23"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:06.764Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:45:47.287Z"}}},"related_cves":[{"value":"CVE-2025-60478","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:eae1eeac-ff0f-43ac-9659-ad1bbc945ce2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60478","advisory_id":"eae1eeac-ff0f-43ac-9659-ad1bbc945ce2","event_types":["advisory"],"published_at":"2026-10-25T14:44:18.907499+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52404"},"members":[{"id":52404,"cve_ids":["CVE-2025-60478"],"payload":{"kind":"advisory","title":"CVE-2025-60478","summary":"A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.","evidence":"cve:CVE-2025-60478","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60478","aliases":["CVE-2025-60478"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:06.764Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3300","https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/README.md","https://infosec.exchange/@sigdevel/117456560052551246"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/23"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:06.764Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T14:45:47.287Z"}}},"related_cves":[{"value":"CVE-2025-60478","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:eae1eeac-ff0f-43ac-9659-ad1bbc945ce2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60478","advisory_id":"eae1eeac-ff0f-43ac-9659-ad1bbc945ce2","event_types":["advisory"],"published_at":"2026-10-25T14:44:18.907499+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52404"}]}},{"id":52875,"cve_ids":["CVE-2025-60469"],"payload":{"kind":"advisory","title":"CVE-2025-60469","summary":"A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-60469","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60469","aliases":["CVE-2025-60469"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:04.446Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3292","https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/41/README.md","https://infosec.exchange/@sigdevel/117456377012352192"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:04.446Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T15:13:31.128Z"}}},"related_cves":[{"value":"CVE-2025-60469","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0eed12a4-255c-4e18-9d58-f59c5caa1c4b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60469","advisory_id":"0eed12a4-255c-4e18-9d58-f59c5caa1c4b","event_types":["advisory"],"published_at":"2026-10-25T14:44:18.321572+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A0eed12a4-255c-4e18-9d58-f59c5caa1c4b","group":{"id":"advisory:0eed12a4-255c-4e18-9d58-f59c5caa1c4b","revision":1,"primary_event_id":52403,"change":"published","superseded_by":[],"changed":{"id":52403,"cve_ids":["CVE-2025-60469"],"payload":{"kind":"advisory","title":"CVE-2025-60469","summary":"A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-60469","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60469","aliases":["CVE-2025-60469"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:04.446Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3292","https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/41/README.md","https://infosec.exchange/@sigdevel/117456377012352192"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:04.446Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T15:13:31.128Z"}}},"related_cves":[{"value":"CVE-2025-60469","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0eed12a4-255c-4e18-9d58-f59c5caa1c4b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60469","advisory_id":"0eed12a4-255c-4e18-9d58-f59c5caa1c4b","event_types":["advisory"],"published_at":"2026-10-25T14:44:18.321572+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52403"},"members":[{"id":52403,"cve_ids":["CVE-2025-60469"],"payload":{"kind":"advisory","title":"CVE-2025-60469","summary":"A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.","evidence":"cve:CVE-2025-60469","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-60469","aliases":["CVE-2025-60469"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T21:07:04.446Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3292","https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b","https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/41/README.md","https://infosec.exchange/@sigdevel/117456377012352192"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/22/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-22T21:07:04.446Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-21T15:13:31.128Z"}}},"related_cves":[{"value":"CVE-2025-60469","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0eed12a4-255c-4e18-9d58-f59c5caa1c4b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-60469","advisory_id":"0eed12a4-255c-4e18-9d58-f59c5caa1c4b","event_types":["advisory"],"published_at":"2026-10-25T14:44:18.321572+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:00:00+00:00","detail_url":"/events/52403"}]}},{"id":50995,"cve_ids":["CVE-2025-69723"],"payload":{"kind":"advisory","title":"CVE-2025-69723","summary":"A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.","evidence":"cve:CVE-2025-69723","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-69723","aliases":["CVE-2025-69723"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T18:05:58.540Z","provider":"cve","references":["https://cyberroute.github.io/post/2025-12-11-localstack-hack/"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T18:05:58.540Z"}}},"related_cves":[{"value":"CVE-2025-69723","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78f66483-bafc-4efd-addd-c7acf1cf4c46","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-69723","advisory_id":"78f66483-bafc-4efd-addd-c7acf1cf4c46","event_types":["advisory"],"published_at":"2026-10-25T14:07:46.566191+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/advisories/advisory%3A78f66483-bafc-4efd-addd-c7acf1cf4c46","group":{"id":"advisory:78f66483-bafc-4efd-addd-c7acf1cf4c46","revision":1,"primary_event_id":50523,"change":"published","superseded_by":[],"changed":{"id":50523,"cve_ids":["CVE-2025-69723"],"payload":{"kind":"advisory","title":"CVE-2025-69723","summary":"A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.","evidence":"cve:CVE-2025-69723","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-69723","aliases":["CVE-2025-69723"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T18:05:58.540Z","provider":"cve","references":["https://cyberroute.github.io/post/2025-12-11-localstack-hack/"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T18:05:58.540Z"}}},"related_cves":[{"value":"CVE-2025-69723","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78f66483-bafc-4efd-addd-c7acf1cf4c46","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-69723","advisory_id":"78f66483-bafc-4efd-addd-c7acf1cf4c46","event_types":["advisory"],"published_at":"2026-10-25T14:07:46.566191+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50523"},"members":[{"id":50523,"cve_ids":["CVE-2025-69723"],"payload":{"kind":"advisory","title":"CVE-2025-69723","summary":"A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.","evidence":"cve:CVE-2025-69723","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-69723","aliases":["CVE-2025-69723"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T18:05:58.540Z","provider":"cve","references":["https://cyberroute.github.io/post/2025-12-11-localstack-hack/"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T18:05:58.540Z"}}},"related_cves":[{"value":"CVE-2025-69723","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:78f66483-bafc-4efd-addd-c7acf1cf4c46","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-69723","advisory_id":"78f66483-bafc-4efd-addd-c7acf1cf4c46","event_types":["advisory"],"published_at":"2026-10-25T14:07:46.566191+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50523"}]}},{"id":50994,"cve_ids":["CVE-2025-65200"],"payload":{"kind":"advisory","title":"CVE-2025-65200","summary":"An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the docker container.","evidence":"cve:CVE-2025-65200","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-65200","aliases":["CVE-2025-65200"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T18:05:18.644Z","provider":"cve","references":["https://github.com/localstack/localstack/blob/aba1ee84592d76f0a88dd286fcd83b65080e31ac/localstack-core/localstack/services/cloudformation/deploy_ui.py","https://github.com/localstack/localstack/pull/13293/","https://cyberroute.github.io/post/2025-12-11-localstack-hack/"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T18:05:18.644Z"}}},"related_cves":[{"value":"CVE-2025-65200","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e24bba61-99dc-4faf-afee-6ba1c45e1d97","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-65200","advisory_id":"e24bba61-99dc-4faf-afee-6ba1c45e1d97","event_types":["advisory"],"published_at":"2026-10-25T14:07:45.936262+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/advisories/advisory%3Ae24bba61-99dc-4faf-afee-6ba1c45e1d97","group":{"id":"advisory:e24bba61-99dc-4faf-afee-6ba1c45e1d97","revision":1,"primary_event_id":50522,"change":"published","superseded_by":[],"changed":{"id":50522,"cve_ids":["CVE-2025-65200"],"payload":{"kind":"advisory","title":"CVE-2025-65200","summary":"An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the docker container.","evidence":"cve:CVE-2025-65200","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-65200","aliases":["CVE-2025-65200"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T18:05:18.644Z","provider":"cve","references":["https://github.com/localstack/localstack/blob/aba1ee84592d76f0a88dd286fcd83b65080e31ac/localstack-core/localstack/services/cloudformation/deploy_ui.py","https://github.com/localstack/localstack/pull/13293/","https://cyberroute.github.io/post/2025-12-11-localstack-hack/"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T18:05:18.644Z"}}},"related_cves":[{"value":"CVE-2025-65200","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e24bba61-99dc-4faf-afee-6ba1c45e1d97","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-65200","advisory_id":"e24bba61-99dc-4faf-afee-6ba1c45e1d97","event_types":["advisory"],"published_at":"2026-10-25T14:07:45.936262+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50522"},"members":[{"id":50522,"cve_ids":["CVE-2025-65200"],"payload":{"kind":"advisory","title":"CVE-2025-65200","summary":"An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the docker container.","evidence":"cve:CVE-2025-65200","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-65200","aliases":["CVE-2025-65200"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T18:05:18.644Z","provider":"cve","references":["https://github.com/localstack/localstack/blob/aba1ee84592d76f0a88dd286fcd83b65080e31ac/localstack-core/localstack/services/cloudformation/deploy_ui.py","https://github.com/localstack/localstack/pull/13293/","https://cyberroute.github.io/post/2025-12-11-localstack-hack/"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T18:05:18.644Z"}}},"related_cves":[{"value":"CVE-2025-65200","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e24bba61-99dc-4faf-afee-6ba1c45e1d97","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-65200","advisory_id":"e24bba61-99dc-4faf-afee-6ba1c45e1d97","event_types":["advisory"],"published_at":"2026-10-25T14:07:45.936262+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50522"}]}},{"id":50859,"cve_ids":["CVE-2026-51954"],"payload":{"kind":"advisory","title":"CVE-2026-51954","summary":"An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.","evidence":"cve:CVE-2026-51954","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-51954","aliases":["CVE-2026-51954"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T15:42:26.798Z","provider":"cve","references":["https://github.com/webasyst/webasyst-framework/issues/389","https://support.webasyst.com/forum/48658/unvalidated-redirect_uri-in-oauth-authorization-flow-allows-authorization-code-interception-and-permanent-api-access/","https://github.com/Envincion/CVE-2026-51954"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T15:42:26.798Z"}}},"related_cves":[{"value":"CVE-2026-51954","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fd5db549-3b72-4d5a-ad82-1a81d471c728","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-51954","advisory_id":"fd5db549-3b72-4d5a-ad82-1a81d471c728","event_types":["advisory"],"published_at":"2026-10-25T14:05:46.48386+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/advisories/advisory%3Afd5db549-3b72-4d5a-ad82-1a81d471c728","group":{"id":"advisory:fd5db549-3b72-4d5a-ad82-1a81d471c728","revision":1,"primary_event_id":50387,"change":"published","superseded_by":[],"changed":{"id":50387,"cve_ids":["CVE-2026-51954"],"payload":{"kind":"advisory","title":"CVE-2026-51954","summary":"An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.","evidence":"cve:CVE-2026-51954","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-51954","aliases":["CVE-2026-51954"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T15:42:26.798Z","provider":"cve","references":["https://github.com/webasyst/webasyst-framework/issues/389","https://support.webasyst.com/forum/48658/unvalidated-redirect_uri-in-oauth-authorization-flow-allows-authorization-code-interception-and-permanent-api-access/","https://github.com/Envincion/CVE-2026-51954"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T15:42:26.798Z"}}},"related_cves":[{"value":"CVE-2026-51954","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fd5db549-3b72-4d5a-ad82-1a81d471c728","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-51954","advisory_id":"fd5db549-3b72-4d5a-ad82-1a81d471c728","event_types":["advisory"],"published_at":"2026-10-25T14:05:46.48386+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50387"},"members":[{"id":50387,"cve_ids":["CVE-2026-51954"],"payload":{"kind":"advisory","title":"CVE-2026-51954","summary":"An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.","evidence":"cve:CVE-2026-51954","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-51954","aliases":["CVE-2026-51954"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T15:42:26.798Z","provider":"cve","references":["https://github.com/webasyst/webasyst-framework/issues/389","https://support.webasyst.com/forum/48658/unvalidated-redirect_uri-in-oauth-authorization-flow-allows-authorization-code-interception-and-permanent-api-access/","https://github.com/Envincion/CVE-2026-51954"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T15:42:26.798Z"}}},"related_cves":[{"value":"CVE-2026-51954","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fd5db549-3b72-4d5a-ad82-1a81d471c728","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-51954","advisory_id":"fd5db549-3b72-4d5a-ad82-1a81d471c728","event_types":["advisory"],"published_at":"2026-10-25T14:05:46.48386+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50387"}]}},{"id":50762,"cve_ids":["CVE-2026-78846"],"payload":{"kind":"advisory","title":"CVE-2026-78846","summary":"AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing.","evidence":"cve:CVE-2026-78846","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-78846","aliases":["CVE-2026-78846"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T14:20:04.518Z","provider":"cve","references":["https://www.aidot.com/vulnerability-disclosure-policy","https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T14:20:04.518Z"}}},"related_cves":[{"value":"CVE-2026-78846","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:26156ad2-5df9-4f1f-a1e5-a4164fc3e9c5","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78846","advisory_id":"26156ad2-5df9-4f1f-a1e5-a4164fc3e9c5","event_types":["advisory"],"published_at":"2026-10-25T14:04:32.54495+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/advisories/advisory%3A26156ad2-5df9-4f1f-a1e5-a4164fc3e9c5","group":{"id":"advisory:26156ad2-5df9-4f1f-a1e5-a4164fc3e9c5","revision":1,"primary_event_id":50290,"change":"published","superseded_by":[],"changed":{"id":50290,"cve_ids":["CVE-2026-78846"],"payload":{"kind":"advisory","title":"CVE-2026-78846","summary":"AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing.","evidence":"cve:CVE-2026-78846","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-78846","aliases":["CVE-2026-78846"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T14:20:04.518Z","provider":"cve","references":["https://www.aidot.com/vulnerability-disclosure-policy","https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T14:20:04.518Z"}}},"related_cves":[{"value":"CVE-2026-78846","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:26156ad2-5df9-4f1f-a1e5-a4164fc3e9c5","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78846","advisory_id":"26156ad2-5df9-4f1f-a1e5-a4164fc3e9c5","event_types":["advisory"],"published_at":"2026-10-25T14:04:32.54495+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50290"},"members":[{"id":50290,"cve_ids":["CVE-2026-78846"],"payload":{"kind":"advisory","title":"CVE-2026-78846","summary":"AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing.","evidence":"cve:CVE-2026-78846","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-78846","aliases":["CVE-2026-78846"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T14:20:04.518Z","provider":"cve","references":["https://www.aidot.com/vulnerability-disclosure-policy","https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T14:20:04.518Z"}}},"related_cves":[{"value":"CVE-2026-78846","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:26156ad2-5df9-4f1f-a1e5-a4164fc3e9c5","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78846","advisory_id":"26156ad2-5df9-4f1f-a1e5-a4164fc3e9c5","event_types":["advisory"],"published_at":"2026-10-25T14:04:32.54495+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50290"}]}},{"id":50761,"cve_ids":["CVE-2026-78801"],"payload":{"kind":"advisory","title":"CVE-2026-78801","summary":"An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch","evidence":"cve:CVE-2026-78801","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-78801","aliases":["CVE-2026-78801"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T14:17:34.244Z","provider":"cve","references":["https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T14:17:34.244Z"}}},"related_cves":[{"value":"CVE-2026-78801","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f58708fb-6f62-46da-894e-aee26d6f234b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78801","advisory_id":"f58708fb-6f62-46da-894e-aee26d6f234b","event_types":["advisory"],"published_at":"2026-10-25T14:04:31.692891+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/advisories/advisory%3Af58708fb-6f62-46da-894e-aee26d6f234b","group":{"id":"advisory:f58708fb-6f62-46da-894e-aee26d6f234b","revision":1,"primary_event_id":50289,"change":"published","superseded_by":[],"changed":{"id":50289,"cve_ids":["CVE-2026-78801"],"payload":{"kind":"advisory","title":"CVE-2026-78801","summary":"An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch","evidence":"cve:CVE-2026-78801","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-78801","aliases":["CVE-2026-78801"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T14:17:34.244Z","provider":"cve","references":["https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T14:17:34.244Z"}}},"related_cves":[{"value":"CVE-2026-78801","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f58708fb-6f62-46da-894e-aee26d6f234b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78801","advisory_id":"f58708fb-6f62-46da-894e-aee26d6f234b","event_types":["advisory"],"published_at":"2026-10-25T14:04:31.692891+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50289"},"members":[{"id":50289,"cve_ids":["CVE-2026-78801"],"payload":{"kind":"advisory","title":"CVE-2026-78801","summary":"An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch","evidence":"cve:CVE-2026-78801","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-78801","aliases":["CVE-2026-78801"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T14:17:34.244Z","provider":"cve","references":["https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T14:17:34.244Z"}}},"related_cves":[{"value":"CVE-2026-78801","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f58708fb-6f62-46da-894e-aee26d6f234b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-78801","advisory_id":"f58708fb-6f62-46da-894e-aee26d6f234b","event_types":["advisory"],"published_at":"2026-10-25T14:04:31.692891+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50289"}]}},{"id":50759,"cve_ids":["CVE-2026-107079"],"payload":{"kind":"advisory","title":"CVE-2026-107079","summary":"An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html component","evidence":"cve:CVE-2026-107079","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-107079","aliases":["CVE-2026-107079"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T13:59:17.589Z","provider":"cve","references":["https://github.com/Malav-MK/Systrome-Validation-Certification.git","https://github.com/Malav-MK/Systrome-Validation-Certification/blob/main/CVE-2026-107079.md"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T13:59:17.589Z"}}},"related_cves":[{"value":"CVE-2026-107079","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62742da0-d75f-4cd7-96a2-ccd2dd6c061f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107079","advisory_id":"62742da0-d75f-4cd7-96a2-ccd2dd6c061f","event_types":["advisory"],"published_at":"2026-10-25T14:04:30.386671+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/advisories/advisory%3A62742da0-d75f-4cd7-96a2-ccd2dd6c061f","group":{"id":"advisory:62742da0-d75f-4cd7-96a2-ccd2dd6c061f","revision":1,"primary_event_id":50287,"change":"published","superseded_by":[],"changed":{"id":50287,"cve_ids":["CVE-2026-107079"],"payload":{"kind":"advisory","title":"CVE-2026-107079","summary":"An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html component","evidence":"cve:CVE-2026-107079","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-107079","aliases":["CVE-2026-107079"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T13:59:17.589Z","provider":"cve","references":["https://github.com/Malav-MK/Systrome-Validation-Certification.git","https://github.com/Malav-MK/Systrome-Validation-Certification/blob/main/CVE-2026-107079.md"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T13:59:17.589Z"}}},"related_cves":[{"value":"CVE-2026-107079","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62742da0-d75f-4cd7-96a2-ccd2dd6c061f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107079","advisory_id":"62742da0-d75f-4cd7-96a2-ccd2dd6c061f","event_types":["advisory"],"published_at":"2026-10-25T14:04:30.386671+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50287"},"members":[{"id":50287,"cve_ids":["CVE-2026-107079"],"payload":{"kind":"advisory","title":"CVE-2026-107079","summary":"An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html component","evidence":"cve:CVE-2026-107079","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-107079","aliases":["CVE-2026-107079"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T13:59:17.589Z","provider":"cve","references":["https://github.com/Malav-MK/Systrome-Validation-Certification.git","https://github.com/Malav-MK/Systrome-Validation-Certification/blob/main/CVE-2026-107079.md"],"provider_metadata":{"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-22T13:59:17.589Z"}}},"related_cves":[{"value":"CVE-2026-107079","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:62742da0-d75f-4cd7-96a2-ccd2dd6c061f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107079","advisory_id":"62742da0-d75f-4cd7-96a2-ccd2dd6c061f","event_types":["advisory"],"published_at":"2026-10-25T14:04:30.386671+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T00:00:00+00:00","detail_url":"/events/50287"}]}},{"id":50548,"cve_ids":["CVE-2026-107081"],"payload":{"kind":"advisory","title":"CVE-2026-107081","summary":"SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.","evidence":"cve:CVE-2026-107081","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-107081","aliases":["CVE-2026-107081"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T02:26:03.172Z","provider":"cve","references":["https://github.com/slims/slims9_bulian/issues/391","https://github.com/Primandito/CVE-2026-107081"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-107081","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-22T02:25:14.912967Z"}}}],"references":[{"url":"https://github.com/slims/slims9_bulian/issues/391","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T02:26:03.172Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-19T15:57:12.887Z"}}},"related_cves":[{"value":"CVE-2026-107081","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b0f702a3-93c0-4706-91a7-35540ab5d708","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107081","advisory_id":"b0f702a3-93c0-4706-91a7-35540ab5d708","event_types":["advisory"],"published_at":"2026-10-25T14:00:13.891593+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T00:00:00+00:00","detail_url":"/advisories/advisory%3Ab0f702a3-93c0-4706-91a7-35540ab5d708","group":{"id":"advisory:b0f702a3-93c0-4706-91a7-35540ab5d708","revision":1,"primary_event_id":50076,"change":"published","superseded_by":[],"changed":{"id":50076,"cve_ids":["CVE-2026-107081"],"payload":{"kind":"advisory","title":"CVE-2026-107081","summary":"SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.","evidence":"cve:CVE-2026-107081","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-107081","aliases":["CVE-2026-107081"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T02:26:03.172Z","provider":"cve","references":["https://github.com/slims/slims9_bulian/issues/391","https://github.com/Primandito/CVE-2026-107081"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-107081","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-22T02:25:14.912967Z"}}}],"references":[{"url":"https://github.com/slims/slims9_bulian/issues/391","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T02:26:03.172Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-19T15:57:12.887Z"}}},"related_cves":[{"value":"CVE-2026-107081","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b0f702a3-93c0-4706-91a7-35540ab5d708","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107081","advisory_id":"b0f702a3-93c0-4706-91a7-35540ab5d708","event_types":["advisory"],"published_at":"2026-10-25T14:00:13.891593+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T00:00:00+00:00","detail_url":"/events/50076"},"members":[{"id":50076,"cve_ids":["CVE-2026-107081"],"payload":{"kind":"advisory","title":"CVE-2026-107081","summary":"SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.php) in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.","evidence":"cve:CVE-2026-107081","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-107081","aliases":["CVE-2026-107081"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T02:26:03.172Z","provider":"cve","references":["https://github.com/slims/slims9_bulian/issues/391","https://github.com/Primandito/CVE-2026-107081"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-107081","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-22T02:25:14.912967Z"}}}],"references":[{"url":"https://github.com/slims/slims9_bulian/issues/391","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T02:26:03.172Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-19T15:57:12.887Z"}}},"related_cves":[{"value":"CVE-2026-107081","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b0f702a3-93c0-4706-91a7-35540ab5d708","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107081","advisory_id":"b0f702a3-93c0-4706-91a7-35540ab5d708","event_types":["advisory"],"published_at":"2026-10-25T14:00:13.891593+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T00:00:00+00:00","detail_url":"/events/50076"}]}},{"id":50546,"cve_ids":["CVE-2025-55654"],"payload":{"kind":"advisory","title":"CVE-2025-55654","summary":"A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.","evidence":"cve:CVE-2025-55654","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-55654","aliases":["CVE-2025-55654"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T02:27:44.110Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3249","https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","https://infosec.exchange/@sigdevel/116769098607015606"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/7"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:47.467Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-55654","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T02:26:59.597908Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3249","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-416","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T02:27:44.110Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-19T17:49:09.174Z"}}},"related_cves":[{"value":"CVE-2025-55654","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4289b6c4-6b31-4471-8845-287bb809acfa","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-55654","advisory_id":"4289b6c4-6b31-4471-8845-287bb809acfa","event_types":["advisory"],"published_at":"2026-10-25T14:00:12.514939+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T00:00:00+00:00","detail_url":"/advisories/advisory%3A4289b6c4-6b31-4471-8845-287bb809acfa","group":{"id":"advisory:4289b6c4-6b31-4471-8845-287bb809acfa","revision":1,"primary_event_id":50074,"change":"published","superseded_by":[],"changed":{"id":50074,"cve_ids":["CVE-2025-55654"],"payload":{"kind":"advisory","title":"CVE-2025-55654","summary":"A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.","evidence":"cve:CVE-2025-55654","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-55654","aliases":["CVE-2025-55654"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T02:27:44.110Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3249","https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","https://infosec.exchange/@sigdevel/116769098607015606"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/7"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:47.467Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-55654","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T02:26:59.597908Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3249","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-416","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T02:27:44.110Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-19T17:49:09.174Z"}}},"related_cves":[{"value":"CVE-2025-55654","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4289b6c4-6b31-4471-8845-287bb809acfa","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-55654","advisory_id":"4289b6c4-6b31-4471-8845-287bb809acfa","event_types":["advisory"],"published_at":"2026-10-25T14:00:12.514939+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T00:00:00+00:00","detail_url":"/events/50074"},"members":[{"id":50074,"cve_ids":["CVE-2025-55654"],"payload":{"kind":"advisory","title":"CVE-2025-55654","summary":"A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.","evidence":"cve:CVE-2025-55654","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-55654","aliases":["CVE-2025-55654"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-22T02:27:44.110Z","provider":"cve","references":["https://github.com/gpac/gpac/issues/3249","https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","https://infosec.exchange/@sigdevel/116769098607015606"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/7"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:47.467Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-55654","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-22T02:26:59.597908Z"}}}],"references":[{"url":"https://github.com/gpac/gpac/issues/3249","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-416","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-22T02:27:44.110Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-19T17:49:09.174Z"}}},"related_cves":[{"value":"CVE-2025-55654","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4289b6c4-6b31-4471-8845-287bb809acfa","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-55654","advisory_id":"4289b6c4-6b31-4471-8845-287bb809acfa","event_types":["advisory"],"published_at":"2026-10-25T14:00:12.514939+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-19T00:00:00+00:00","detail_url":"/events/50074"}]}},{"id":49886,"cve_ids":["CVE-2026-95168"],"payload":{"kind":"advisory","title":"CVE-2026-95168","summary":"An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py","evidence":"cve:CVE-2026-95168","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-95168","aliases":["CVE-2026-95168"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-21T19:17:42.649Z","provider":"cve","references":["https://github.com/nvbn/thefuck/issues/1623","https://github.com/REYu6/python-vuln/blob/main/reports-v2/thefuck/03-contrib-pregate-exec.md"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-95168","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-21T19:17:11.473482Z"}}}],"references":[{"url":"https://github.com/nvbn/thefuck/issues/1623","tags":["exploit"]},{"url":"https://github.com/REYu6/python-vuln/blob/main/reports-v2/thefuck/03-contrib-pregate-exec.md","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:17:42.649Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T14:43:15.620Z"}}},"related_cves":[{"value":"CVE-2026-95168","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:950a6322-3de8-4d8f-9a1e-b2d6cccb0cf2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95168","advisory_id":"950a6322-3de8-4d8f-9a1e-b2d6cccb0cf2","event_types":["advisory"],"published_at":"2026-10-25T13:49:42.642223+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/advisories/advisory%3A950a6322-3de8-4d8f-9a1e-b2d6cccb0cf2","group":{"id":"advisory:950a6322-3de8-4d8f-9a1e-b2d6cccb0cf2","revision":1,"primary_event_id":49414,"change":"published","superseded_by":[],"changed":{"id":49414,"cve_ids":["CVE-2026-95168"],"payload":{"kind":"advisory","title":"CVE-2026-95168","summary":"An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py","evidence":"cve:CVE-2026-95168","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-95168","aliases":["CVE-2026-95168"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-21T19:17:42.649Z","provider":"cve","references":["https://github.com/nvbn/thefuck/issues/1623","https://github.com/REYu6/python-vuln/blob/main/reports-v2/thefuck/03-contrib-pregate-exec.md"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-95168","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-21T19:17:11.473482Z"}}}],"references":[{"url":"https://github.com/nvbn/thefuck/issues/1623","tags":["exploit"]},{"url":"https://github.com/REYu6/python-vuln/blob/main/reports-v2/thefuck/03-contrib-pregate-exec.md","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:17:42.649Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T14:43:15.620Z"}}},"related_cves":[{"value":"CVE-2026-95168","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:950a6322-3de8-4d8f-9a1e-b2d6cccb0cf2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95168","advisory_id":"950a6322-3de8-4d8f-9a1e-b2d6cccb0cf2","event_types":["advisory"],"published_at":"2026-10-25T13:49:42.642223+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/events/49414"},"members":[{"id":49414,"cve_ids":["CVE-2026-95168"],"payload":{"kind":"advisory","title":"CVE-2026-95168","summary":"An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py","evidence":"cve:CVE-2026-95168","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-95168","aliases":["CVE-2026-95168"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-21T19:17:42.649Z","provider":"cve","references":["https://github.com/nvbn/thefuck/issues/1623","https://github.com/REYu6/python-vuln/blob/main/reports-v2/thefuck/03-contrib-pregate-exec.md"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-95168","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-21T19:17:11.473482Z"}}}],"references":[{"url":"https://github.com/nvbn/thefuck/issues/1623","tags":["exploit"]},{"url":"https://github.com/REYu6/python-vuln/blob/main/reports-v2/thefuck/03-contrib-pregate-exec.md","tags":["exploit"]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T19:17:42.649Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-20T14:43:15.620Z"}}},"related_cves":[{"value":"CVE-2026-95168","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:950a6322-3de8-4d8f-9a1e-b2d6cccb0cf2","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95168","advisory_id":"950a6322-3de8-4d8f-9a1e-b2d6cccb0cf2","event_types":["advisory"],"published_at":"2026-10-25T13:49:42.642223+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T00:00:00+00:00","detail_url":"/events/49414"}]}},{"id":45464,"cve_ids":["CVE-2026-95183"],"payload":{"kind":"advisory","title":"CVE-2026-95183","summary":"An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.","evidence":"cve:CVE-2026-95183","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-95183","aliases":["CVE-2026-95183"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-21T01:55:26.148Z","provider":"cve","references":["https://gist.github.com/lkloliver/c54c0cc91e1ec4f16b538e0d8a1411b6"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-95183","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-21T01:54:28.151341Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T01:55:26.148Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-16T14:16:29.687Z"}}},"related_cves":[{"value":"CVE-2026-95183","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fe8d8bf1-50c1-4064-a6e9-e20c536e4562","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95183","advisory_id":"fe8d8bf1-50c1-4064-a6e9-e20c536e4562","event_types":["advisory"],"published_at":"2026-10-25T12:26:28.471542+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T00:00:00+00:00","detail_url":"/advisories/advisory%3Afe8d8bf1-50c1-4064-a6e9-e20c536e4562","group":{"id":"advisory:fe8d8bf1-50c1-4064-a6e9-e20c536e4562","revision":1,"primary_event_id":45029,"change":"published","superseded_by":[],"changed":{"id":45029,"cve_ids":["CVE-2026-95183"],"payload":{"kind":"advisory","title":"CVE-2026-95183","summary":"An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.","evidence":"cve:CVE-2026-95183","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-95183","aliases":["CVE-2026-95183"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-21T01:55:26.148Z","provider":"cve","references":["https://gist.github.com/lkloliver/c54c0cc91e1ec4f16b538e0d8a1411b6"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-95183","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-21T01:54:28.151341Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T01:55:26.148Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-16T14:16:29.687Z"}}},"related_cves":[{"value":"CVE-2026-95183","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fe8d8bf1-50c1-4064-a6e9-e20c536e4562","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95183","advisory_id":"fe8d8bf1-50c1-4064-a6e9-e20c536e4562","event_types":["advisory"],"published_at":"2026-10-25T12:26:28.471542+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T00:00:00+00:00","detail_url":"/events/45029"},"members":[{"id":45029,"cve_ids":["CVE-2026-95183"],"payload":{"kind":"advisory","title":"CVE-2026-95183","summary":"An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.","evidence":"cve:CVE-2026-95183","products":[{"name":{"value":"n/a","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-95183","aliases":["CVE-2026-95183"],"metrics":[],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"modified":"2026-10-21T01:55:26.148Z","provider":"cve","references":["https://gist.github.com/lkloliver/c54c0cc91e1ec4f16b538e0d8a1411b6"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-95183","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-21T01:54:28.151341Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T01:55:26.148Z"}}],"cna":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-16T14:16:29.687Z"}}},"related_cves":[{"value":"CVE-2026-95183","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:fe8d8bf1-50c1-4064-a6e9-e20c536e4562","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95183","advisory_id":"fe8d8bf1-50c1-4064-a6e9-e20c536e4562","event_types":["advisory"],"published_at":"2026-10-25T12:26:28.471542+00:00","technologies":["core-cve","n-a"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T00:00:00+00:00","detail_url":"/events/45029"}]}}],"next_after":56155,"next_before":45464}