{"schema_version":"2","view":"grouped","data":[{"id":72190,"cve_ids":["CVE-2026-104437"],"payload":{"kind":"advisory","title":"Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling","summary":"Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.","evidence":"cve:CVE-2026-104437","products":[{"name":{"value":"zebra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104437","aliases":["CVE-2026-104437"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"0","lessThan":"4.4.0","versionType":"semver"},{"status":"unaffected","version":"4.4.0","versionType":"semver"}],"packageURL":"pkg:cargo/zebrad","defaultStatus":"unaffected"}],"modified":"2026-10-06T02:42:57.596Z","provider":"cve","references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp","https://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104437","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T02:42:33.915856Z"}}}],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T02:42:57.596Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:38:13.855Z"}}},"related_cves":[{"value":"CVE-2026-104437","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ccb6a735-3980-4f92-bdca-bf33bdf825c3","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-104437","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"}],"products":[{"name":{"value":"zebrad","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.4.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-cwfq-rfcr-8hmp","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104437","advisory_id":"ccb6a735-3980-4f92-bdca-bf33bdf825c3","event_types":["advisory"],"published_at":"2026-10-26T00:18:30.146511+00:00","technologies":["core-cve","zebra"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-02T11:38:13.855+00:00","detail_url":"/advisories/advisory%3Accb6a735-3980-4f92-bdca-bf33bdf825c3","group":{"id":"advisory:ccb6a735-3980-4f92-bdca-bf33bdf825c3","revision":2,"primary_event_id":72834,"change":"context","superseded_by":[],"changed":{"id":72834,"cve_ids":["CVE-2026-104437"],"payload":{"kind":"advisory","title":"Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling","summary":"Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.","evidence":"cve:CVE-2026-104437","products":[{"name":{"value":"zebra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104437","aliases":["CVE-2026-104437"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"0","lessThan":"4.4.0","versionType":"semver"},{"status":"unaffected","version":"4.4.0","versionType":"semver"}],"packageURL":"pkg:cargo/zebrad","defaultStatus":"unaffected"}],"modified":"2026-10-06T02:42:57.596Z","provider":"cve","references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp","https://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104437","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T02:42:33.915856Z"}}}],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T02:42:57.596Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:38:13.855Z"}}},"related_cves":[{"value":"CVE-2026-104437","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ccb6a735-3980-4f92-bdca-bf33bdf825c3","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-104437","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"}],"products":[{"name":{"value":"zebrad","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.4.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-cwfq-rfcr-8hmp","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104437","advisory_id":"ccb6a735-3980-4f92-bdca-bf33bdf825c3","event_types":["advisory"],"published_at":"2026-10-26T00:18:30.146511+00:00","technologies":["core-cve","zebra"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-02T11:38:13.855+00:00","detail_url":"/events/72834"},"members":[{"id":72834,"cve_ids":["CVE-2026-104437"],"payload":{"kind":"advisory","title":"Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling","summary":"Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.","evidence":"cve:CVE-2026-104437","products":[{"name":{"value":"zebra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104437","aliases":["CVE-2026-104437"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"0","lessThan":"4.4.0","versionType":"semver"},{"status":"unaffected","version":"4.4.0","versionType":"semver"}],"packageURL":"pkg:cargo/zebrad","defaultStatus":"unaffected"}],"modified":"2026-10-06T02:42:57.596Z","provider":"cve","references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp","https://www.vulncheck.com/advisories/zebra-before-4.4.0-consensus-split-via-sighash-single-missing-output-handling"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104437","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T02:42:33.915856Z"}}}],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-cwfq-rfcr-8hmp","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-06T02:42:57.596Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:38:13.855Z"}}},"related_cves":[{"value":"CVE-2026-104437","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ccb6a735-3980-4f92-bdca-bf33bdf825c3","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-104437","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"}],"products":[{"name":{"value":"zebrad","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.4.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-cwfq-rfcr-8hmp","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104437","advisory_id":"ccb6a735-3980-4f92-bdca-bf33bdf825c3","event_types":["advisory"],"published_at":"2026-10-26T00:18:30.146511+00:00","technologies":["core-cve","zebra"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-02T11:38:13.855+00:00","detail_url":"/events/72834"}]}},{"id":72188,"cve_ids":["CVE-2026-104435"],"payload":{"kind":"advisory","title":"Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output","summary":"Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.","evidence":"cve:CVE-2026-104435","products":[{"name":{"value":"zebra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"zebra","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104435","aliases":["CVE-2026-104435"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"4.4.0","lessThan":"4.4.1","versionType":"semver"},{"status":"unaffected","version":"4.4.1","versionType":"semver"}],"packageURL":"pkg:cargo/zebrad","defaultStatus":"unaffected"},{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"6.0.0","lessThan":"6.0.1","versionType":"semver"},{"status":"unaffected","version":"6.0.1","versionType":"semver"}],"packageURL":"pkg:cargo/zebra-script","defaultStatus":"unaffected"}],"modified":"2026-10-02T15:16:42.729Z","provider":"cve","references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-pvmv-cwg8-v6c8","https://www.vulncheck.com/advisories/zebra-4.4.0-consensus-divergence-via-v5-sighash-single-without-output"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104435","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T15:16:28.895399Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T15:16:42.729Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:38:12.487Z"}}},"related_cves":[{"value":"CVE-2026-104435","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d86b5aa9-660f-4a45-91c9-f7fc36f31454","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-104435","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H"}],"products":[{"name":{"value":"zebrad","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.4.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"zebra-script","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.0.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-pvmv-cwg8-v6c8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104435","advisory_id":"d86b5aa9-660f-4a45-91c9-f7fc36f31454","event_types":["advisory"],"published_at":"2026-10-26T00:18:29.367286+00:00","technologies":["core-cve","zebra"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-02T11:38:12.487+00:00","detail_url":"/advisories/advisory%3Ad86b5aa9-660f-4a45-91c9-f7fc36f31454","group":{"id":"advisory:d86b5aa9-660f-4a45-91c9-f7fc36f31454","revision":2,"primary_event_id":72832,"change":"context","superseded_by":[],"changed":{"id":72832,"cve_ids":["CVE-2026-104435"],"payload":{"kind":"advisory","title":"Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output","summary":"Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.","evidence":"cve:CVE-2026-104435","products":[{"name":{"value":"zebra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"zebra","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104435","aliases":["CVE-2026-104435"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"4.4.0","lessThan":"4.4.1","versionType":"semver"},{"status":"unaffected","version":"4.4.1","versionType":"semver"}],"packageURL":"pkg:cargo/zebrad","defaultStatus":"unaffected"},{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"6.0.0","lessThan":"6.0.1","versionType":"semver"},{"status":"unaffected","version":"6.0.1","versionType":"semver"}],"packageURL":"pkg:cargo/zebra-script","defaultStatus":"unaffected"}],"modified":"2026-10-02T15:16:42.729Z","provider":"cve","references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-pvmv-cwg8-v6c8","https://www.vulncheck.com/advisories/zebra-4.4.0-consensus-divergence-via-v5-sighash-single-without-output"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104435","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T15:16:28.895399Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T15:16:42.729Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:38:12.487Z"}}},"related_cves":[{"value":"CVE-2026-104435","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d86b5aa9-660f-4a45-91c9-f7fc36f31454","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-104435","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H"}],"products":[{"name":{"value":"zebrad","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.4.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"zebra-script","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.0.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-pvmv-cwg8-v6c8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104435","advisory_id":"d86b5aa9-660f-4a45-91c9-f7fc36f31454","event_types":["advisory"],"published_at":"2026-10-26T00:18:29.367286+00:00","technologies":["core-cve","zebra"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-02T11:38:12.487+00:00","detail_url":"/events/72832"},"members":[{"id":72832,"cve_ids":["CVE-2026-104435"],"payload":{"kind":"advisory","title":"Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output","summary":"Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.","evidence":"cve:CVE-2026-104435","products":[{"name":{"value":"zebra","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"zebra","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-104435","aliases":["CVE-2026-104435"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"4.4.0","lessThan":"4.4.1","versionType":"semver"},{"status":"unaffected","version":"4.4.1","versionType":"semver"}],"packageURL":"pkg:cargo/zebrad","defaultStatus":"unaffected"},{"vendor":"ZcashFoundation","product":"zebra","versions":[{"status":"affected","version":"6.0.0","lessThan":"6.0.1","versionType":"semver"},{"status":"unaffected","version":"6.0.1","versionType":"semver"}],"packageURL":"pkg:cargo/zebra-script","defaultStatus":"unaffected"}],"modified":"2026-10-02T15:16:42.729Z","provider":"cve","references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-pvmv-cwg8-v6c8","https://www.vulncheck.com/advisories/zebra-4.4.0-consensus-divergence-via-v5-sighash-single-without-output"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-104435","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-02T15:16:28.895399Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T15:16:42.729Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-02T11:38:12.487Z"}}},"related_cves":[{"value":"CVE-2026-104435","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d86b5aa9-660f-4a45-91c9-f7fc36f31454","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-104435","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H"}],"products":[{"name":{"value":"zebrad","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.4.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"zebra-script","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.0.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-pvmv-cwg8-v6c8","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104435","advisory_id":"d86b5aa9-660f-4a45-91c9-f7fc36f31454","event_types":["advisory"],"published_at":"2026-10-26T00:18:29.367286+00:00","technologies":["core-cve","zebra"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-02T11:38:12.487+00:00","detail_url":"/events/72832"}]}},{"id":72046,"cve_ids":["CVE-2026-116006"],"payload":{"kind":"advisory","title":"YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication","summary":"A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116006","products":[{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116006","aliases":["CVE-2026-116006"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"YunaiV","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]},{"cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"zhijiantianya","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]}],"modified":"2026-10-25T03:30:25.691Z","provider":"cve","references":["https://vuldb.com/vuln/426103","https://vuldb.com/vuln/426103/cti","https://vuldb.com/cve/CVE-2026-116006","https://vuldb.com/submit/993199","https://gist.github.com/Fulucky0-yuri/1ad8a1f166af7cb85c498473753a8636"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T03:30:25.691Z"}}},"related_cves":[{"value":"CVE-2026-116006","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c7257439-c5cc-43ab-9c57-d594d364090e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116006","advisory_id":"c7257439-c5cc-43ab-9c57-d594d364090e","event_types":["advisory"],"published_at":"2026-10-26T00:13:04.611677+00:00","technologies":["core-cve","ruoyi-vue-pro"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T03:30:25.691+00:00","detail_url":"/advisories/advisory%3Ac7257439-c5cc-43ab-9c57-d594d364090e","group":{"id":"advisory:c7257439-c5cc-43ab-9c57-d594d364090e","revision":1,"primary_event_id":72669,"change":"published","superseded_by":[],"changed":{"id":72669,"cve_ids":["CVE-2026-116006"],"payload":{"kind":"advisory","title":"YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication","summary":"A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116006","products":[{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116006","aliases":["CVE-2026-116006"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"YunaiV","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]},{"cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"zhijiantianya","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]}],"modified":"2026-10-25T03:30:25.691Z","provider":"cve","references":["https://vuldb.com/vuln/426103","https://vuldb.com/vuln/426103/cti","https://vuldb.com/cve/CVE-2026-116006","https://vuldb.com/submit/993199","https://gist.github.com/Fulucky0-yuri/1ad8a1f166af7cb85c498473753a8636"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T03:30:25.691Z"}}},"related_cves":[{"value":"CVE-2026-116006","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c7257439-c5cc-43ab-9c57-d594d364090e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116006","advisory_id":"c7257439-c5cc-43ab-9c57-d594d364090e","event_types":["advisory"],"published_at":"2026-10-26T00:13:04.611677+00:00","technologies":["core-cve","ruoyi-vue-pro"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T03:30:25.691+00:00","detail_url":"/events/72669"},"members":[{"id":72669,"cve_ids":["CVE-2026-116006"],"payload":{"kind":"advisory","title":"YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication","summary":"A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116006","products":[{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116006","aliases":["CVE-2026-116006"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"YunaiV","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]},{"cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"zhijiantianya","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]}],"modified":"2026-10-25T03:30:25.691Z","provider":"cve","references":["https://vuldb.com/vuln/426103","https://vuldb.com/vuln/426103/cti","https://vuldb.com/cve/CVE-2026-116006","https://vuldb.com/submit/993199","https://gist.github.com/Fulucky0-yuri/1ad8a1f166af7cb85c498473753a8636"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T03:30:25.691Z"}}},"related_cves":[{"value":"CVE-2026-116006","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c7257439-c5cc-43ab-9c57-d594d364090e","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116006","advisory_id":"c7257439-c5cc-43ab-9c57-d594d364090e","event_types":["advisory"],"published_at":"2026-10-26T00:13:04.611677+00:00","technologies":["core-cve","ruoyi-vue-pro"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T03:30:25.691+00:00","detail_url":"/events/72669"}]}},{"id":72044,"cve_ids":["CVE-2026-116007"],"payload":{"kind":"advisory","title":"YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication","summary":"A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116007","products":[{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116007","aliases":["CVE-2026-116007"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":2.6,"vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"YunaiV","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]},{"cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"zhijiantianya","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]}],"modified":"2026-10-25T03:45:16.651Z","provider":"cve","references":["https://vuldb.com/vuln/426104","https://vuldb.com/vuln/426104/cti","https://vuldb.com/cve/CVE-2026-116007","https://vuldb.com/submit/993200","https://gist.github.com/Fulucky0-yuri/63e3a697ec79ffd41c1cbfdbb1fcd5b4"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T03:45:16.651Z"}}},"related_cves":[{"value":"CVE-2026-116007","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2bb72345-75e2-4969-ab3c-222eb66ce246","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116007","advisory_id":"2bb72345-75e2-4969-ab3c-222eb66ce246","event_types":["advisory"],"published_at":"2026-10-26T00:12:54.793452+00:00","technologies":["core-cve","ruoyi-vue-pro"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T03:45:16.651+00:00","detail_url":"/advisories/advisory%3A2bb72345-75e2-4969-ab3c-222eb66ce246","group":{"id":"advisory:2bb72345-75e2-4969-ab3c-222eb66ce246","revision":1,"primary_event_id":72667,"change":"published","superseded_by":[],"changed":{"id":72667,"cve_ids":["CVE-2026-116007"],"payload":{"kind":"advisory","title":"YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication","summary":"A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116007","products":[{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116007","aliases":["CVE-2026-116007"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":2.6,"vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"YunaiV","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]},{"cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"zhijiantianya","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]}],"modified":"2026-10-25T03:45:16.651Z","provider":"cve","references":["https://vuldb.com/vuln/426104","https://vuldb.com/vuln/426104/cti","https://vuldb.com/cve/CVE-2026-116007","https://vuldb.com/submit/993200","https://gist.github.com/Fulucky0-yuri/63e3a697ec79ffd41c1cbfdbb1fcd5b4"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T03:45:16.651Z"}}},"related_cves":[{"value":"CVE-2026-116007","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2bb72345-75e2-4969-ab3c-222eb66ce246","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116007","advisory_id":"2bb72345-75e2-4969-ab3c-222eb66ce246","event_types":["advisory"],"published_at":"2026-10-26T00:12:54.793452+00:00","technologies":["core-cve","ruoyi-vue-pro"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T03:45:16.651+00:00","detail_url":"/events/72667"},"members":[{"id":72667,"cve_ids":["CVE-2026-116007"],"payload":{"kind":"advisory","title":"YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication","summary":"A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116007","products":[{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"ruoyi-vue-pro","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116007","aliases":["CVE-2026-116007"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":2.6,"vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"YunaiV","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]},{"cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"vendor":"zhijiantianya","modules":["SMS Code Verification"],"product":"ruoyi-vue-pro","versions":[{"status":"affected","version":"2026.09"}]}],"modified":"2026-10-25T03:45:16.651Z","provider":"cve","references":["https://vuldb.com/vuln/426104","https://vuldb.com/vuln/426104/cti","https://vuldb.com/cve/CVE-2026-116007","https://vuldb.com/submit/993200","https://gist.github.com/Fulucky0-yuri/63e3a697ec79ffd41c1cbfdbb1fcd5b4"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T03:45:16.651Z"}}},"related_cves":[{"value":"CVE-2026-116007","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2bb72345-75e2-4969-ab3c-222eb66ce246","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116007","advisory_id":"2bb72345-75e2-4969-ab3c-222eb66ce246","event_types":["advisory"],"published_at":"2026-10-26T00:12:54.793452+00:00","technologies":["core-cve","ruoyi-vue-pro"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T03:45:16.651+00:00","detail_url":"/events/72667"}]}},{"id":72043,"cve_ids":["CVE-2026-114820"],"payload":{"kind":"advisory","title":"CVE-2026-114820","summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/","evidence":"cve:CVE-2026-114820","products":[{"name":{"value":"Oracle Java SE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Oracle GraalVM for JDK","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Oracle GraalVM Enterprise Edition","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-114820","aliases":["CVE-2026-114820"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Oracle Corporation","product":"Oracle Java SE","versions":[{"status":"affected","version":"8u511-b32"},{"status":"affected","version":"8u511-perf-b32"},{"status":"affected","version":"11.0.33.0.2"},{"status":"affected","version":"17.0.21.0.2"},{"status":"affected","version":"21.0.13.0.2"},{"status":"affected","version":"25.0.5.0.2"},{"status":"affected","version":"27.0.1.0.2"}]},{"vendor":"Oracle Corporation","product":"Oracle GraalVM for JDK","versions":[{"status":"affected","version":"17.0.21.0.2"},{"status":"affected","version":"21.0.13.0.2"}]},{"vendor":"Oracle Corporation","product":"Oracle GraalVM Enterprise Edition","versions":[{"status":"affected","version":"21.3.20.0.2"}]}],"modified":"2026-10-25T03:55:32.751Z","provider":"cve","references":["https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114820","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-327","description":"CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-25T03:55:32.751Z"}}],"cna":{"orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle","dateUpdated":"2026-10-24T18:42:04.571Z"}}},"related_cves":[{"value":"CVE-2026-114820","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b447af9b-399e-4ff9-b6a6-fd95534d0fdf","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114820","advisory_id":"b447af9b-399e-4ff9-b6a6-fd95534d0fdf","event_types":["advisory"],"published_at":"2026-10-26T00:12:53.587123+00:00","technologies":["core-cve","oracle-graalvm-enterprise-edition","oracle-graalvm-for-jdk","oracle-java-se"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T18:42:04.571+00:00","detail_url":"/advisories/advisory%3Ab447af9b-399e-4ff9-b6a6-fd95534d0fdf","group":{"id":"advisory:b447af9b-399e-4ff9-b6a6-fd95534d0fdf","revision":1,"primary_event_id":72666,"change":"published","superseded_by":[],"changed":{"id":72666,"cve_ids":["CVE-2026-114820"],"payload":{"kind":"advisory","title":"CVE-2026-114820","summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/","evidence":"cve:CVE-2026-114820","products":[{"name":{"value":"Oracle Java SE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Oracle GraalVM for JDK","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Oracle GraalVM Enterprise Edition","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-114820","aliases":["CVE-2026-114820"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Oracle Corporation","product":"Oracle Java SE","versions":[{"status":"affected","version":"8u511-b32"},{"status":"affected","version":"8u511-perf-b32"},{"status":"affected","version":"11.0.33.0.2"},{"status":"affected","version":"17.0.21.0.2"},{"status":"affected","version":"21.0.13.0.2"},{"status":"affected","version":"25.0.5.0.2"},{"status":"affected","version":"27.0.1.0.2"}]},{"vendor":"Oracle Corporation","product":"Oracle GraalVM for JDK","versions":[{"status":"affected","version":"17.0.21.0.2"},{"status":"affected","version":"21.0.13.0.2"}]},{"vendor":"Oracle Corporation","product":"Oracle GraalVM Enterprise Edition","versions":[{"status":"affected","version":"21.3.20.0.2"}]}],"modified":"2026-10-25T03:55:32.751Z","provider":"cve","references":["https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114820","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-327","description":"CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-25T03:55:32.751Z"}}],"cna":{"orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle","dateUpdated":"2026-10-24T18:42:04.571Z"}}},"related_cves":[{"value":"CVE-2026-114820","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b447af9b-399e-4ff9-b6a6-fd95534d0fdf","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114820","advisory_id":"b447af9b-399e-4ff9-b6a6-fd95534d0fdf","event_types":["advisory"],"published_at":"2026-10-26T00:12:53.587123+00:00","technologies":["core-cve","oracle-graalvm-enterprise-edition","oracle-graalvm-for-jdk","oracle-java-se"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T18:42:04.571+00:00","detail_url":"/events/72666"},"members":[{"id":72666,"cve_ids":["CVE-2026-114820"],"payload":{"kind":"advisory","title":"CVE-2026-114820","summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/","evidence":"cve:CVE-2026-114820","products":[{"name":{"value":"Oracle Java SE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Oracle GraalVM for JDK","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Oracle GraalVM Enterprise Edition","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-114820","aliases":["CVE-2026-114820"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"Oracle Corporation","product":"Oracle Java SE","versions":[{"status":"affected","version":"8u511-b32"},{"status":"affected","version":"8u511-perf-b32"},{"status":"affected","version":"11.0.33.0.2"},{"status":"affected","version":"17.0.21.0.2"},{"status":"affected","version":"21.0.13.0.2"},{"status":"affected","version":"25.0.5.0.2"},{"status":"affected","version":"27.0.1.0.2"}]},{"vendor":"Oracle Corporation","product":"Oracle GraalVM for JDK","versions":[{"status":"affected","version":"17.0.21.0.2"},{"status":"affected","version":"21.0.13.0.2"}]},{"vendor":"Oracle Corporation","product":"Oracle GraalVM Enterprise Edition","versions":[{"status":"affected","version":"21.3.20.0.2"}]}],"modified":"2026-10-25T03:55:32.751Z","provider":"cve","references":["https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114820","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-24T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-327","description":"CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-25T03:55:32.751Z"}}],"cna":{"orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle","dateUpdated":"2026-10-24T18:42:04.571Z"}}},"related_cves":[{"value":"CVE-2026-114820","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b447af9b-399e-4ff9-b6a6-fd95534d0fdf","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114820","advisory_id":"b447af9b-399e-4ff9-b6a6-fd95534d0fdf","event_types":["advisory"],"published_at":"2026-10-26T00:12:53.587123+00:00","technologies":["core-cve","oracle-graalvm-enterprise-edition","oracle-graalvm-for-jdk","oracle-java-se"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T18:42:04.571+00:00","detail_url":"/events/72666"}]}},{"id":64646,"cve_ids":["CVE-2026-82405"],"payload":{"kind":"advisory","title":"Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim's default self-signer as authorization. UpdatePermission can then replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82405","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82405","aliases":["CVE-2026-82405"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:05:37.458Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm","https://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32","https://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82405","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T14:03:22.911530Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:05:37.458Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:26:12.967Z"}}},"related_cves":[{"value":"CVE-2026-82405","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cb6ceeb8-6778-4065-b0ca-6fb439ec139d","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82405","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-97cv-x867-6xhm","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82405","advisory_id":"cb6ceeb8-6778-4065-b0ca-6fb439ec139d","event_types":["advisory"],"published_at":"2026-10-25T19:52:59.872561+00:00","technologies":["core-cve","klever-go"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T19:26:12.967+00:00","detail_url":"/advisories/advisory%3Acb6ceeb8-6778-4065-b0ca-6fb439ec139d","group":{"id":"advisory:cb6ceeb8-6778-4065-b0ca-6fb439ec139d","revision":1,"primary_event_id":63981,"change":"published","superseded_by":[],"changed":{"id":63981,"cve_ids":["CVE-2026-82405"],"payload":{"kind":"advisory","title":"Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim's default self-signer as authorization. UpdatePermission can then replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82405","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82405","aliases":["CVE-2026-82405"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:05:37.458Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm","https://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32","https://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82405","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T14:03:22.911530Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:05:37.458Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:26:12.967Z"}}},"related_cves":[{"value":"CVE-2026-82405","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cb6ceeb8-6778-4065-b0ca-6fb439ec139d","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82405","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-97cv-x867-6xhm","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82405","advisory_id":"cb6ceeb8-6778-4065-b0ca-6fb439ec139d","event_types":["advisory"],"published_at":"2026-10-25T19:52:59.872561+00:00","technologies":["core-cve","klever-go"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T19:26:12.967+00:00","detail_url":"/events/63981"},"members":[{"id":63981,"cve_ids":["CVE-2026-82405"],"payload":{"kind":"advisory","title":"Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim's default self-signer as authorization. UpdatePermission can then replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82405","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82405","aliases":["CVE-2026-82405"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:05:37.458Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm","https://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32","https://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82405","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T14:03:22.911530Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:05:37.458Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:26:12.967Z"}}},"related_cves":[{"value":"CVE-2026-82405","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cb6ceeb8-6778-4065-b0ca-6fb439ec139d","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82405","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-97cv-x867-6xhm","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82405","advisory_id":"cb6ceeb8-6778-4065-b0ca-6fb439ec139d","event_types":["advisory"],"published_at":"2026-10-25T19:52:59.872561+00:00","technologies":["core-cve","klever-go"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T19:26:12.967+00:00","detail_url":"/events/63981"}]}},{"id":64642,"cve_ids":["CVE-2026-82406"],"payload":{"kind":"advisory","title":"Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82406","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82406","aliases":["CVE-2026-82406"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:20:49.353Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c","https://github.com/klever-io/klever-go/pull/16","https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82406","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T15:20:43.702470Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:20:49.353Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:10:23.367Z"}}},"related_cves":[{"value":"CVE-2026-82406","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:feee22fb-e90b-4b2a-a511-464da2eab68f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82406","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-26r5-4mm2-px5c","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82406","advisory_id":"feee22fb-e90b-4b2a-a511-464da2eab68f","event_types":["advisory"],"published_at":"2026-10-25T19:52:57.297146+00:00","technologies":["core-cve","klever-go"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T19:10:23.367+00:00","detail_url":"/advisories/advisory%3Afeee22fb-e90b-4b2a-a511-464da2eab68f","group":{"id":"advisory:feee22fb-e90b-4b2a-a511-464da2eab68f","revision":1,"primary_event_id":63974,"change":"published","superseded_by":[],"changed":{"id":63974,"cve_ids":["CVE-2026-82406"],"payload":{"kind":"advisory","title":"Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82406","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82406","aliases":["CVE-2026-82406"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:20:49.353Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c","https://github.com/klever-io/klever-go/pull/16","https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82406","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T15:20:43.702470Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:20:49.353Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:10:23.367Z"}}},"related_cves":[{"value":"CVE-2026-82406","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:feee22fb-e90b-4b2a-a511-464da2eab68f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82406","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-26r5-4mm2-px5c","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82406","advisory_id":"feee22fb-e90b-4b2a-a511-464da2eab68f","event_types":["advisory"],"published_at":"2026-10-25T19:52:57.297146+00:00","technologies":["core-cve","klever-go"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T19:10:23.367+00:00","detail_url":"/events/63974"},"members":[{"id":63974,"cve_ids":["CVE-2026-82406"],"payload":{"kind":"advisory","title":"Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82406","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82406","aliases":["CVE-2026-82406"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:20:49.353Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c","https://github.com/klever-io/klever-go/pull/16","https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82406","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T15:20:43.702470Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:20:49.353Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:10:23.367Z"}}},"related_cves":[{"value":"CVE-2026-82406","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:feee22fb-e90b-4b2a-a511-464da2eab68f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82406","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-26r5-4mm2-px5c","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82406","advisory_id":"feee22fb-e90b-4b2a-a511-464da2eab68f","event_types":["advisory"],"published_at":"2026-10-25T19:52:57.297146+00:00","technologies":["core-cve","klever-go"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T19:10:23.367+00:00","detail_url":"/events/63974"}]}},{"id":64640,"cve_ids":["CVE-2026-85057"],"payload":{"kind":"advisory","title":"ZITADEL: Actions V1 sandbox escape: host file read via require()","summary":"ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.","evidence":"cve:CVE-2026-85057","products":[{"name":{"value":"zitadel","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85057","aliases":["CVE-2026-85057"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"zitadel","product":"zitadel","versions":[{"status":"affected","version":">= 3.0.0, < 3.4.13"},{"status":"affected","version":">= 4.0.0, < 4.16.1"}]}],"modified":"2026-10-05T15:32:54.542Z","provider":"cve","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","https://github.com/zitadel/zitadel/releases/tag/v3.4.13","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85057","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-05T14:53:03.930118Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T15:32:54.542Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:31:19.929Z"}}},"related_cves":[{"value":"CVE-2026-85057","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5bccf186-80b9-438d-bd77-4c8c6b1099eb","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85057","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"}],"products":[{"name":{"value":"github.com/zitadel/zitadel","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.80.0-v2.20.0.20260717062331-baf6ed501b68","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-fgmf-7rf8-m6vf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85057","advisory_id":"5bccf186-80b9-438d-bd77-4c8c6b1099eb","event_types":["advisory"],"published_at":"2026-10-25T19:52:55.805132+00:00","technologies":["core-cve","zitadel"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T17:31:19.929+00:00","detail_url":"/advisories/advisory%3A5bccf186-80b9-438d-bd77-4c8c6b1099eb","group":{"id":"advisory:5bccf186-80b9-438d-bd77-4c8c6b1099eb","revision":1,"primary_event_id":63970,"change":"published","superseded_by":[],"changed":{"id":63970,"cve_ids":["CVE-2026-85057"],"payload":{"kind":"advisory","title":"ZITADEL: Actions V1 sandbox escape: host file read via require()","summary":"ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.","evidence":"cve:CVE-2026-85057","products":[{"name":{"value":"zitadel","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85057","aliases":["CVE-2026-85057"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"zitadel","product":"zitadel","versions":[{"status":"affected","version":">= 3.0.0, < 3.4.13"},{"status":"affected","version":">= 4.0.0, < 4.16.1"}]}],"modified":"2026-10-05T15:32:54.542Z","provider":"cve","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","https://github.com/zitadel/zitadel/releases/tag/v3.4.13","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85057","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-05T14:53:03.930118Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T15:32:54.542Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:31:19.929Z"}}},"related_cves":[{"value":"CVE-2026-85057","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5bccf186-80b9-438d-bd77-4c8c6b1099eb","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85057","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"}],"products":[{"name":{"value":"github.com/zitadel/zitadel","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.80.0-v2.20.0.20260717062331-baf6ed501b68","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-fgmf-7rf8-m6vf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85057","advisory_id":"5bccf186-80b9-438d-bd77-4c8c6b1099eb","event_types":["advisory"],"published_at":"2026-10-25T19:52:55.805132+00:00","technologies":["core-cve","zitadel"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:31:19.929+00:00","detail_url":"/events/63970"},"members":[{"id":63970,"cve_ids":["CVE-2026-85057"],"payload":{"kind":"advisory","title":"ZITADEL: Actions V1 sandbox escape: host file read via require()","summary":"ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.","evidence":"cve:CVE-2026-85057","products":[{"name":{"value":"zitadel","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85057","aliases":["CVE-2026-85057"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"zitadel","product":"zitadel","versions":[{"status":"affected","version":">= 3.0.0, < 3.4.13"},{"status":"affected","version":">= 4.0.0, < 4.16.1"}]}],"modified":"2026-10-05T15:32:54.542Z","provider":"cve","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","https://github.com/zitadel/zitadel/releases/tag/v3.4.13","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85057","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-05T14:53:03.930118Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T15:32:54.542Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:31:19.929Z"}}},"related_cves":[{"value":"CVE-2026-85057","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5bccf186-80b9-438d-bd77-4c8c6b1099eb","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85057","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"}],"products":[{"name":{"value":"github.com/zitadel/zitadel","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.80.0-v2.20.0.20260717062331-baf6ed501b68","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-fgmf-7rf8-m6vf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85057","advisory_id":"5bccf186-80b9-438d-bd77-4c8c6b1099eb","event_types":["advisory"],"published_at":"2026-10-25T19:52:55.805132+00:00","technologies":["core-cve","zitadel"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:31:19.929+00:00","detail_url":"/events/63970"}]}},{"id":64637,"cve_ids":["CVE-2026-85056"],"payload":{"kind":"advisory","title":"ZITADEL: MFA bypass via session reuse in Login V2","summary":"ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.","evidence":"cve:CVE-2026-85056","products":[{"name":{"value":"zitadel","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85056","aliases":["CVE-2026-85056"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"zitadel","product":"zitadel","versions":[{"status":"affected","version":">= 4.0.0, < 4.16.1"}]}],"modified":"2026-09-28T14:56:04.082Z","provider":"cve","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf","https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db","https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85056","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:55:51.988985Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T14:56:04.082Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:34:13.328Z"}}},"related_cves":[{"value":"CVE-2026-85056","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d20c3e51-e555-468f-980c-c028854d9e3f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85056","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"}],"products":[{"name":{"value":"github.com/zitadel/zitadel","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.80.0-v2.20.0.20260717062356-56f4798ed31f","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9993-rfwp-rhwf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85056","advisory_id":"d20c3e51-e555-468f-980c-c028854d9e3f","event_types":["advisory"],"published_at":"2026-10-25T19:52:53.636205+00:00","technologies":["core-cve","zitadel"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T17:34:13.328+00:00","detail_url":"/advisories/advisory%3Ad20c3e51-e555-468f-980c-c028854d9e3f","group":{"id":"advisory:d20c3e51-e555-468f-980c-c028854d9e3f","revision":1,"primary_event_id":63965,"change":"published","superseded_by":[],"changed":{"id":63965,"cve_ids":["CVE-2026-85056"],"payload":{"kind":"advisory","title":"ZITADEL: MFA bypass via session reuse in Login V2","summary":"ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.","evidence":"cve:CVE-2026-85056","products":[{"name":{"value":"zitadel","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85056","aliases":["CVE-2026-85056"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"zitadel","product":"zitadel","versions":[{"status":"affected","version":">= 4.0.0, < 4.16.1"}]}],"modified":"2026-09-28T14:56:04.082Z","provider":"cve","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf","https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db","https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85056","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:55:51.988985Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T14:56:04.082Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:34:13.328Z"}}},"related_cves":[{"value":"CVE-2026-85056","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d20c3e51-e555-468f-980c-c028854d9e3f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85056","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"}],"products":[{"name":{"value":"github.com/zitadel/zitadel","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.80.0-v2.20.0.20260717062356-56f4798ed31f","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9993-rfwp-rhwf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85056","advisory_id":"d20c3e51-e555-468f-980c-c028854d9e3f","event_types":["advisory"],"published_at":"2026-10-25T19:52:53.636205+00:00","technologies":["core-cve","zitadel"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:34:13.328+00:00","detail_url":"/events/63965"},"members":[{"id":63965,"cve_ids":["CVE-2026-85056"],"payload":{"kind":"advisory","title":"ZITADEL: MFA bypass via session reuse in Login V2","summary":"ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.","evidence":"cve:CVE-2026-85056","products":[{"name":{"value":"zitadel","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-85056","aliases":["CVE-2026-85056"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"zitadel","product":"zitadel","versions":[{"status":"affected","version":">= 4.0.0, < 4.16.1"}]}],"modified":"2026-09-28T14:56:04.082Z","provider":"cve","references":["https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf","https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db","https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43","https://github.com/zitadel/zitadel/releases/tag/v4.16.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-85056","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T14:55:51.988985Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T14:56:04.082Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:34:13.328Z"}}},"related_cves":[{"value":"CVE-2026-85056","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d20c3e51-e555-468f-980c-c028854d9e3f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-85056","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"}],"products":[{"name":{"value":"github.com/zitadel/zitadel","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.80.0-v2.20.0.20260717062356-56f4798ed31f","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9993-rfwp-rhwf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85056","advisory_id":"d20c3e51-e555-468f-980c-c028854d9e3f","event_types":["advisory"],"published_at":"2026-10-25T19:52:53.636205+00:00","technologies":["core-cve","zitadel"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:34:13.328+00:00","detail_url":"/events/63965"}]}},{"id":64629,"cve_ids":["CVE-2026-82409"],"payload":{"kind":"advisory","title":"Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82409","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82409","aliases":["CVE-2026-82409"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:22:11.550Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82409","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T15:22:05.678124Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:22:11.550Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:23:45.954Z"}}},"related_cves":[{"value":"CVE-2026-82409","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dd1a5921-77ce-4c5f-a05c-052e6bb4be02","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82409","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7c7c-373r-gfjj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82409","advisory_id":"dd1a5921-77ce-4c5f-a05c-052e6bb4be02","event_types":["advisory"],"published_at":"2026-10-25T19:52:47.393459+00:00","technologies":["core-cve","klever-go"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T19:23:45.954+00:00","detail_url":"/advisories/advisory%3Add1a5921-77ce-4c5f-a05c-052e6bb4be02","group":{"id":"advisory:dd1a5921-77ce-4c5f-a05c-052e6bb4be02","revision":1,"primary_event_id":63949,"change":"published","superseded_by":[],"changed":{"id":63949,"cve_ids":["CVE-2026-82409"],"payload":{"kind":"advisory","title":"Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82409","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82409","aliases":["CVE-2026-82409"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:22:11.550Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82409","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T15:22:05.678124Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:22:11.550Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:23:45.954Z"}}},"related_cves":[{"value":"CVE-2026-82409","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dd1a5921-77ce-4c5f-a05c-052e6bb4be02","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82409","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7c7c-373r-gfjj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82409","advisory_id":"dd1a5921-77ce-4c5f-a05c-052e6bb4be02","event_types":["advisory"],"published_at":"2026-10-25T19:52:47.393459+00:00","technologies":["core-cve","klever-go"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T19:23:45.954+00:00","detail_url":"/events/63949"},"members":[{"id":63949,"cve_ids":["CVE-2026-82409"],"payload":{"kind":"advisory","title":"Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-82409","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-82409","aliases":["CVE-2026-82409"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-24T15:22:11.550Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-82409","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T15:22:05.678124Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T15:22:11.550Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:23:45.954Z"}}},"related_cves":[{"value":"CVE-2026-82409","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dd1a5921-77ce-4c5f-a05c-052e6bb4be02","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-82409","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7c7c-373r-gfjj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-82409","advisory_id":"dd1a5921-77ce-4c5f-a05c-052e6bb4be02","event_types":["advisory"],"published_at":"2026-10-25T19:52:47.393459+00:00","technologies":["core-cve","klever-go"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T19:23:45.954+00:00","detail_url":"/events/63949"}]}},{"id":64610,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/advisories/advisory%3Acc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","group":{"id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","revision":1,"primary_event_id":63919,"change":"published","superseded_by":[],"changed":{"id":63919,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/events/63919"},"members":[{"id":63919,"cve_ids":["CVE-2026-63131"],"payload":{"kind":"advisory","title":"OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-63131","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-63131","aliases":["CVE-2026-63131"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"< 2.6.0"}]}],"modified":"2026-09-24T14:15:04.716Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","https://github.com/openbao/openbao/pull/3389","https://github.com/openbao/openbao/pull/3474","https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63131","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T14:14:55.010515Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T14:15:04.716Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T17:59:16.337Z"}}},"related_cves":[{"value":"CVE-2026-63131","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-63131","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-63131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63131","advisory_id":"cc83fef7-8ff2-4a08-b76e-5a9d58ef45bd","event_types":["advisory"],"published_at":"2026-10-25T19:52:29.340122+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T17:59:16.337+00:00","detail_url":"/events/63919"}]}},{"id":64606,"cve_ids":["CVE-2026-62369"],"payload":{"kind":"advisory","title":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join","summary":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","evidence":"cve:CVE-2026-62369","products":[{"name":{"value":"kubeedge","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62369","aliases":["CVE-2026-62369"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"kubeedge","product":"kubeedge","versions":[{"status":"affected","version":">= 1.16.0, < 1.21.2"},{"status":"affected","version":">= 1.22.0, < 1.22.2"},{"status":"affected","version":">= 1.23.0, < 1.23.1"}]}],"modified":"2026-09-24T22:24:33.145Z","provider":"cve","references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047","https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62369","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:24:17.190529Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:24:33.145Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T17:10:57.979Z"}}},"related_cves":[{"value":"CVE-2026-62369","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a997b08c-8e3b-4ec7-9156-a29d1af33f1b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-62369","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}],"products":[{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.2","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9vm9-pqxx-x83v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62369","advisory_id":"a997b08c-8e3b-4ec7-9156-a29d1af33f1b","event_types":["advisory"],"published_at":"2026-10-25T19:52:26.426997+00:00","technologies":["core-cve","kubeedge"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T17:10:57.979+00:00","detail_url":"/advisories/advisory%3Aa997b08c-8e3b-4ec7-9156-a29d1af33f1b","group":{"id":"advisory:a997b08c-8e3b-4ec7-9156-a29d1af33f1b","revision":1,"primary_event_id":63913,"change":"published","superseded_by":[],"changed":{"id":63913,"cve_ids":["CVE-2026-62369"],"payload":{"kind":"advisory","title":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join","summary":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","evidence":"cve:CVE-2026-62369","products":[{"name":{"value":"kubeedge","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62369","aliases":["CVE-2026-62369"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"kubeedge","product":"kubeedge","versions":[{"status":"affected","version":">= 1.16.0, < 1.21.2"},{"status":"affected","version":">= 1.22.0, < 1.22.2"},{"status":"affected","version":">= 1.23.0, < 1.23.1"}]}],"modified":"2026-09-24T22:24:33.145Z","provider":"cve","references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047","https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62369","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:24:17.190529Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:24:33.145Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T17:10:57.979Z"}}},"related_cves":[{"value":"CVE-2026-62369","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a997b08c-8e3b-4ec7-9156-a29d1af33f1b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-62369","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}],"products":[{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.2","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9vm9-pqxx-x83v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62369","advisory_id":"a997b08c-8e3b-4ec7-9156-a29d1af33f1b","event_types":["advisory"],"published_at":"2026-10-25T19:52:26.426997+00:00","technologies":["core-cve","kubeedge"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-21T17:10:57.979+00:00","detail_url":"/events/63913"},"members":[{"id":63913,"cve_ids":["CVE-2026-62369"],"payload":{"kind":"advisory","title":"KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join","summary":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","evidence":"cve:CVE-2026-62369","products":[{"name":{"value":"kubeedge","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62369","aliases":["CVE-2026-62369"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"kubeedge","product":"kubeedge","versions":[{"status":"affected","version":">= 1.16.0, < 1.21.2"},{"status":"affected","version":">= 1.22.0, < 1.22.2"},{"status":"affected","version":">= 1.23.0, < 1.23.1"}]}],"modified":"2026-09-24T22:24:33.145Z","provider":"cve","references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-9vm9-pqxx-x83v","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/47767b7f2649afcfa3a856e87d556f7777e0428d","https://github.com/kubeedge/kubeedge/commit/a524a66a1ae1691eb8ff16b6ff9a93fb370d4047","https://github.com/kubeedge/kubeedge/commit/ee02dea9d08114afc4a8f401b1c2f30e84e1de40","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62369","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:24:17.190529Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:24:33.145Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T17:10:57.979Z"}}},"related_cves":[{"value":"CVE-2026-62369","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a997b08c-8e3b-4ec7-9156-a29d1af33f1b","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-62369","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}],"products":[{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.2","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9vm9-pqxx-x83v","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62369","advisory_id":"a997b08c-8e3b-4ec7-9156-a29d1af33f1b","event_types":["advisory"],"published_at":"2026-10-25T19:52:26.426997+00:00","technologies":["core-cve","kubeedge"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-21T17:10:57.979+00:00","detail_url":"/events/63913"}]}},{"id":64598,"cve_ids":["CVE-2026-71543"],"payload":{"kind":"advisory","title":"OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-71543","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71543","aliases":["CVE-2026-71543"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"<2.6.0"}]}],"modified":"2026-09-25T19:26:50.747Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p","https://github.com/openbao/openbao/pull/3401","https://github.com/openbao/openbao/pull/3473","https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1","https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71543","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T19:26:34.934696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:26:50.747Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:03:59.159Z"}}},"related_cves":[{"value":"CVE-2026-71543","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b04ed4bc-737d-44ca-8609-ed5fb68f1298","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-71543","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-71543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-71543","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.0.0-20260710001938-2d4ebafec5c5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-59w7-v8rr-pr4p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71543","advisory_id":"b04ed4bc-737d-44ca-8609-ed5fb68f1298","event_types":["advisory"],"published_at":"2026-10-25T19:52:19.742669+00:00","technologies":["core-cve","openbao"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T15:03:59.159+00:00","detail_url":"/advisories/advisory%3Ab04ed4bc-737d-44ca-8609-ed5fb68f1298","group":{"id":"advisory:b04ed4bc-737d-44ca-8609-ed5fb68f1298","revision":1,"primary_event_id":63900,"change":"published","superseded_by":[],"changed":{"id":63900,"cve_ids":["CVE-2026-71543"],"payload":{"kind":"advisory","title":"OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-71543","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71543","aliases":["CVE-2026-71543"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"<2.6.0"}]}],"modified":"2026-09-25T19:26:50.747Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p","https://github.com/openbao/openbao/pull/3401","https://github.com/openbao/openbao/pull/3473","https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1","https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71543","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T19:26:34.934696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:26:50.747Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:03:59.159Z"}}},"related_cves":[{"value":"CVE-2026-71543","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b04ed4bc-737d-44ca-8609-ed5fb68f1298","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-71543","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-71543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-71543","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.0.0-20260710001938-2d4ebafec5c5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-59w7-v8rr-pr4p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71543","advisory_id":"b04ed4bc-737d-44ca-8609-ed5fb68f1298","event_types":["advisory"],"published_at":"2026-10-25T19:52:19.742669+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-21T15:03:59.159+00:00","detail_url":"/events/63900"},"members":[{"id":63900,"cve_ids":["CVE-2026-71543"],"payload":{"kind":"advisory","title":"OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters","summary":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.","evidence":"cve:CVE-2026-71543","products":[{"name":{"value":"openbao","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-71543","aliases":["CVE-2026-71543"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"openbao","product":"openbao","versions":[{"status":"affected","version":"<2.6.0"}]}],"modified":"2026-09-25T19:26:50.747Z","provider":"cve","references":["https://github.com/openbao/openbao/security/advisories/GHSA-59w7-v8rr-pr4p","https://github.com/openbao/openbao/pull/3401","https://github.com/openbao/openbao/pull/3473","https://github.com/openbao/openbao/commit/2d4ebafec5c524408b3d4ac1198df909cb7ac8c1","https://github.com/openbao/openbao/commit/e516ce508e1481504cadbfbf62052364339093bc","https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#201","https://github.com/openbao/openbao/releases/tag/v2.6.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-71543","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-25T19:26:34.934696Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T19:26:50.747Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T15:03:59.159Z"}}},"related_cves":[{"value":"CVE-2026-71543","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b04ed4bc-737d-44ca-8609-ed5fb68f1298","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-71543","metrics":[],"products":[{"name":{"value":"openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.6.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-openbao-2026-71543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"},{"cve":"CVE-2026-71543","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.0.0-20260710001938-2d4ebafec5c5","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/openbao/openbao","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-59w7-v8rr-pr4p","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":3,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-71543","advisory_id":"b04ed4bc-737d-44ca-8609-ed5fb68f1298","event_types":["advisory"],"published_at":"2026-10-25T19:52:19.742669+00:00","technologies":["core-cve","openbao"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-21T15:03:59.159+00:00","detail_url":"/events/63900"}]}},{"id":64592,"cve_ids":["CVE-2026-86065"],"payload":{"kind":"advisory","title":"Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-86065","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-86065","aliases":["CVE-2026-86065"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-29T02:10:29.210Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm","https://github.com/klever-io/klever-go/pull/76","https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-86065","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:10:04.993031Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:10:29.210Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:15:24.271Z"}}},"related_cves":[{"value":"CVE-2026-86065","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:222740f3-1528-4434-b67c-7788c0e9937f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-86065","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-4fwh-wrm6-97xm","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-86065","advisory_id":"222740f3-1528-4434-b67c-7788c0e9937f","event_types":["advisory"],"published_at":"2026-10-25T19:52:15.137576+00:00","technologies":["core-cve","klever-go"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T19:15:24.271+00:00","detail_url":"/advisories/advisory%3A222740f3-1528-4434-b67c-7788c0e9937f","group":{"id":"advisory:222740f3-1528-4434-b67c-7788c0e9937f","revision":1,"primary_event_id":63889,"change":"published","superseded_by":[],"changed":{"id":63889,"cve_ids":["CVE-2026-86065"],"payload":{"kind":"advisory","title":"Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-86065","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-86065","aliases":["CVE-2026-86065"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-29T02:10:29.210Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm","https://github.com/klever-io/klever-go/pull/76","https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-86065","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:10:04.993031Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:10:29.210Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:15:24.271Z"}}},"related_cves":[{"value":"CVE-2026-86065","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:222740f3-1528-4434-b67c-7788c0e9937f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-86065","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-4fwh-wrm6-97xm","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-86065","advisory_id":"222740f3-1528-4434-b67c-7788c0e9937f","event_types":["advisory"],"published_at":"2026-10-25T19:52:15.137576+00:00","technologies":["core-cve","klever-go"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T19:15:24.271+00:00","detail_url":"/events/63889"},"members":[{"id":63889,"cve_ids":["CVE-2026-86065"],"payload":{"kind":"advisory","title":"Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)","summary":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20.","evidence":"cve:CVE-2026-86065","products":[{"name":{"value":"klever-go","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-86065","aliases":["CVE-2026-86065"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"klever-io","product":"klever-go","versions":[{"status":"affected","version":"< 1.7.20"}]}],"modified":"2026-09-29T02:10:29.210Z","provider":"cve","references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm","https://github.com/klever-io/klever-go/pull/76","https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-86065","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T02:10:04.993031Z"}}}],"references":[{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:10:29.210Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-23T19:15:24.271Z"}}},"related_cves":[{"value":"CVE-2026-86065","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:222740f3-1528-4434-b67c-7788c0e9937f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-86065","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"products":[{"name":{"value":"github.com/klever-io/klever-go","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.7.20","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-4fwh-wrm6-97xm","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-86065","advisory_id":"222740f3-1528-4434-b67c-7788c0e9937f","event_types":["advisory"],"published_at":"2026-10-25T19:52:15.137576+00:00","technologies":["core-cve","klever-go"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T19:15:24.271+00:00","detail_url":"/events/63889"}]}},{"id":64587,"cve_ids":["CVE-2026-61604"],"payload":{"kind":"advisory","title":"ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass","summary":"The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor. Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled — later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise — any account holding a balance in a token a bond could use was at risk. This was fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur. All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary. There is no application-level workaround. The vulnerability is in consensus lo","evidence":"cve:CVE-2026-61604","products":[{"name":{"value":"ixo-blockchain","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-61604","aliases":["CVE-2026-61604"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"ixofoundation","product":"ixo-blockchain","versions":[{"status":"affected","version":"< 8.0.0"}]}],"modified":"2026-09-24T18:04:39.737Z","provider":"cve","references":["https://github.com/ixofoundation/ixo-blockchain/security/advisories/GHSA-w3rp-4cm2-4wgc"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T18:02:22.273058Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T18:04:39.737Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:45:20.684Z"}}},"related_cves":[{"value":"CVE-2026-61604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:db6c2beb-baab-42e1-94d1-1e9663e1410c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-61604","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v7","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v6","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v5","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v4","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-w3rp-4cm2-4wgc","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61604","advisory_id":"db6c2beb-baab-42e1-94d1-1e9663e1410c","event_types":["advisory"],"published_at":"2026-10-25T19:52:12.981666+00:00","technologies":["core-cve","ixo-blockchain"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T17:45:20.684+00:00","detail_url":"/advisories/advisory%3Adb6c2beb-baab-42e1-94d1-1e9663e1410c","group":{"id":"advisory:db6c2beb-baab-42e1-94d1-1e9663e1410c","revision":1,"primary_event_id":63883,"change":"published","superseded_by":[],"changed":{"id":63883,"cve_ids":["CVE-2026-61604"],"payload":{"kind":"advisory","title":"ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass","summary":"The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor. Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled — later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise — any account holding a balance in a token a bond could use was at risk. This was fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur. All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary. There is no application-level workaround. The vulnerability is in consensus lo","evidence":"cve:CVE-2026-61604","products":[{"name":{"value":"ixo-blockchain","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-61604","aliases":["CVE-2026-61604"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"ixofoundation","product":"ixo-blockchain","versions":[{"status":"affected","version":"< 8.0.0"}]}],"modified":"2026-09-24T18:04:39.737Z","provider":"cve","references":["https://github.com/ixofoundation/ixo-blockchain/security/advisories/GHSA-w3rp-4cm2-4wgc"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T18:02:22.273058Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T18:04:39.737Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:45:20.684Z"}}},"related_cves":[{"value":"CVE-2026-61604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:db6c2beb-baab-42e1-94d1-1e9663e1410c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-61604","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v7","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v6","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v5","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v4","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-w3rp-4cm2-4wgc","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61604","advisory_id":"db6c2beb-baab-42e1-94d1-1e9663e1410c","event_types":["advisory"],"published_at":"2026-10-25T19:52:12.981666+00:00","technologies":["core-cve","ixo-blockchain"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:45:20.684+00:00","detail_url":"/events/63883"},"members":[{"id":63883,"cve_ids":["CVE-2026-61604"],"payload":{"kind":"advisory","title":"ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass","summary":"The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor. Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled — later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise — any account holding a balance in a token a bond could use was at risk. This was fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur. All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary. There is no application-level workaround. The vulnerability is in consensus lo","evidence":"cve:CVE-2026-61604","products":[{"name":{"value":"ixo-blockchain","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-61604","aliases":["CVE-2026-61604"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"ixofoundation","product":"ixo-blockchain","versions":[{"status":"affected","version":"< 8.0.0"}]}],"modified":"2026-09-24T18:04:39.737Z","provider":"cve","references":["https://github.com/ixofoundation/ixo-blockchain/security/advisories/GHSA-w3rp-4cm2-4wgc"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T18:02:22.273058Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T18:04:39.737Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:45:20.684Z"}}},"related_cves":[{"value":"CVE-2026-61604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:db6c2beb-baab-42e1-94d1-1e9663e1410c","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-61604","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v8","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"8.0.0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v7","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v6","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v5","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v4","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain/v3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"github.com/ixofoundation/ixo-blockchain","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-w3rp-4cm2-4wgc","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61604","advisory_id":"db6c2beb-baab-42e1-94d1-1e9663e1410c","event_types":["advisory"],"published_at":"2026-10-25T19:52:12.981666+00:00","technologies":["core-cve","ixo-blockchain"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:45:20.684+00:00","detail_url":"/events/63883"}]}},{"id":64585,"cve_ids":["CVE-2026-77633"],"payload":{"kind":"advisory","title":"Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service","summary":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.","evidence":"cve:CVE-2026-77633","products":[{"name":{"value":"cloudreve","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-77633","aliases":["CVE-2026-77633"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"cloudreve","product":"cloudreve","versions":[{"status":"affected","version":"< 4.18.0"}]}],"modified":"2026-09-25T23:38:53.232Z","provider":"cve","references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj","https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77633","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T23:38:43.980886Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T23:38:53.232Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T15:28:56.700Z"}}},"related_cves":[{"value":"CVE-2026-77633","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64b9e781-fb84-47e5-9807-31b8f06afa43","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-77633","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"products":[{"name":{"value":"github.com/cloudreve/Cloudreve/v4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0-20260715025621-7329602751c0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-xj3h-wwxq-gfcj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77633","advisory_id":"64b9e781-fb84-47e5-9807-31b8f06afa43","event_types":["advisory"],"published_at":"2026-10-25T19:52:12.213378+00:00","technologies":["cloudreve","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T15:28:56.7+00:00","detail_url":"/advisories/advisory%3A64b9e781-fb84-47e5-9807-31b8f06afa43","group":{"id":"advisory:64b9e781-fb84-47e5-9807-31b8f06afa43","revision":1,"primary_event_id":63880,"change":"published","superseded_by":[],"changed":{"id":63880,"cve_ids":["CVE-2026-77633"],"payload":{"kind":"advisory","title":"Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service","summary":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.","evidence":"cve:CVE-2026-77633","products":[{"name":{"value":"cloudreve","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-77633","aliases":["CVE-2026-77633"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"cloudreve","product":"cloudreve","versions":[{"status":"affected","version":"< 4.18.0"}]}],"modified":"2026-09-25T23:38:53.232Z","provider":"cve","references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj","https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77633","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T23:38:43.980886Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T23:38:53.232Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T15:28:56.700Z"}}},"related_cves":[{"value":"CVE-2026-77633","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64b9e781-fb84-47e5-9807-31b8f06afa43","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-77633","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"products":[{"name":{"value":"github.com/cloudreve/Cloudreve/v4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0-20260715025621-7329602751c0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-xj3h-wwxq-gfcj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77633","advisory_id":"64b9e781-fb84-47e5-9807-31b8f06afa43","event_types":["advisory"],"published_at":"2026-10-25T19:52:12.213378+00:00","technologies":["cloudreve","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-22T15:28:56.7+00:00","detail_url":"/events/63880"},"members":[{"id":63880,"cve_ids":["CVE-2026-77633"],"payload":{"kind":"advisory","title":"Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service","summary":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff. The resulting reservations can exceed the account quota and can be materialized as chunked uploads that exhaust host storage and deny uploads to other users. The default local-storage policy and default User group are affected. This issue is fixed in version 4.18.0.","evidence":"cve:CVE-2026-77633","products":[{"name":{"value":"cloudreve","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-77633","aliases":["CVE-2026-77633"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"cloudreve","product":"cloudreve","versions":[{"status":"affected","version":"< 4.18.0"}]}],"modified":"2026-09-25T23:38:53.232Z","provider":"cve","references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-xj3h-wwxq-gfcj","https://github.com/cloudreve/cloudreve/commit/7329602751c00bb4136fe9ad8b364d0df70773df","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77633","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T23:38:43.980886Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T23:38:53.232Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T15:28:56.700Z"}}},"related_cves":[{"value":"CVE-2026-77633","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64b9e781-fb84-47e5-9807-31b8f06afa43","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-77633","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"products":[{"name":{"value":"github.com/cloudreve/Cloudreve/v4","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0-20260715025621-7329602751c0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-xj3h-wwxq-gfcj","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77633","advisory_id":"64b9e781-fb84-47e5-9807-31b8f06afa43","event_types":["advisory"],"published_at":"2026-10-25T19:52:12.213378+00:00","technologies":["cloudreve","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-22T15:28:56.7+00:00","detail_url":"/events/63880"}]}},{"id":64579,"cve_ids":["CVE-2026-62182"],"payload":{"kind":"advisory","title":"KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes","summary":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","evidence":"cve:CVE-2026-62182","products":[{"name":{"value":"kubeedge","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62182","aliases":["CVE-2026-62182"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"kubeedge","product":"kubeedge","versions":[{"status":"affected","version":">= 1.21.0, < 1.21.2"},{"status":"affected","version":">= 1.22.0, < 1.22.2"},{"status":"affected","version":">= 1.23.0, < 1.23.1"}]}],"modified":"2026-09-24T22:25:52.960Z","provider":"cve","references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-m3c6-2p7h-cfr3","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/14f65fc6207787f266cbcb0dceac7f09a81bab2b","https://github.com/kubeedge/kubeedge/commit/6309a335c8e5e3c154b6bb0a09292f5c7dc598dc","https://github.com/kubeedge/kubeedge/commit/ee78415a36911c1a93e59a921c23b8e4ecd83e90","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62182","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T22:25:44.186709Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:25:52.960Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T17:37:45.702Z"}}},"related_cves":[{"value":"CVE-2026-62182","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a8f40e6a-a6d0-41a9-b4b3-ee694d671f65","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-62182","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.2","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m3c6-2p7h-cfr3","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62182","advisory_id":"a8f40e6a-a6d0-41a9-b4b3-ee694d671f65","event_types":["advisory"],"published_at":"2026-10-25T19:52:07.558136+00:00","technologies":["core-cve","kubeedge"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-21T17:37:45.702+00:00","detail_url":"/advisories/advisory%3Aa8f40e6a-a6d0-41a9-b4b3-ee694d671f65","group":{"id":"advisory:a8f40e6a-a6d0-41a9-b4b3-ee694d671f65","revision":1,"primary_event_id":63871,"change":"published","superseded_by":[],"changed":{"id":63871,"cve_ids":["CVE-2026-62182"],"payload":{"kind":"advisory","title":"KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes","summary":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","evidence":"cve:CVE-2026-62182","products":[{"name":{"value":"kubeedge","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62182","aliases":["CVE-2026-62182"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"kubeedge","product":"kubeedge","versions":[{"status":"affected","version":">= 1.21.0, < 1.21.2"},{"status":"affected","version":">= 1.22.0, < 1.22.2"},{"status":"affected","version":">= 1.23.0, < 1.23.1"}]}],"modified":"2026-09-24T22:25:52.960Z","provider":"cve","references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-m3c6-2p7h-cfr3","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/14f65fc6207787f266cbcb0dceac7f09a81bab2b","https://github.com/kubeedge/kubeedge/commit/6309a335c8e5e3c154b6bb0a09292f5c7dc598dc","https://github.com/kubeedge/kubeedge/commit/ee78415a36911c1a93e59a921c23b8e4ecd83e90","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62182","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T22:25:44.186709Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:25:52.960Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T17:37:45.702Z"}}},"related_cves":[{"value":"CVE-2026-62182","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a8f40e6a-a6d0-41a9-b4b3-ee694d671f65","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-62182","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.2","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m3c6-2p7h-cfr3","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62182","advisory_id":"a8f40e6a-a6d0-41a9-b4b3-ee694d671f65","event_types":["advisory"],"published_at":"2026-10-25T19:52:07.558136+00:00","technologies":["core-cve","kubeedge"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-21T17:37:45.702+00:00","detail_url":"/events/63871"},"members":[{"id":63871,"cve_ids":["CVE-2026-62182"],"payload":{"kind":"advisory","title":"KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes","summary":"KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.","evidence":"cve:CVE-2026-62182","products":[{"name":{"value":"kubeedge","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62182","aliases":["CVE-2026-62182"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"kubeedge","product":"kubeedge","versions":[{"status":"affected","version":">= 1.21.0, < 1.21.2"},{"status":"affected","version":">= 1.22.0, < 1.22.2"},{"status":"affected","version":">= 1.23.0, < 1.23.1"}]}],"modified":"2026-09-24T22:25:52.960Z","provider":"cve","references":["https://github.com/kubeedge/kubeedge/security/advisories/GHSA-m3c6-2p7h-cfr3","https://github.com/kubeedge/kubeedge/pull/7028","https://github.com/kubeedge/kubeedge/pull/7029","https://github.com/kubeedge/kubeedge/pull/7030","https://github.com/kubeedge/kubeedge/commit/14f65fc6207787f266cbcb0dceac7f09a81bab2b","https://github.com/kubeedge/kubeedge/commit/6309a335c8e5e3c154b6bb0a09292f5c7dc598dc","https://github.com/kubeedge/kubeedge/commit/ee78415a36911c1a93e59a921c23b8e4ecd83e90","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md","https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md","https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2","https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62182","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T22:25:44.186709Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:25:52.960Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T17:37:45.702Z"}}},"related_cves":[{"value":"CVE-2026-62182","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a8f40e6a-a6d0-41a9-b4b3-ee694d671f65","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-62182","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"products":[{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.21.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.22.2","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"github.com/kubeedge/kubeedge","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.23.1","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-m3c6-2p7h-cfr3","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62182","advisory_id":"a8f40e6a-a6d0-41a9-b4b3-ee694d671f65","event_types":["advisory"],"published_at":"2026-10-25T19:52:07.558136+00:00","technologies":["core-cve","kubeedge"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-21T17:37:45.702+00:00","detail_url":"/events/63871"}]}},{"id":63682,"cve_ids":["CVE-2026-116000"],"payload":{"kind":"advisory","title":"Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery","summary":"A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116000","products":[{"name":{"value":"PrivateGPT","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116000","aliases":["CVE-2026-116000"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:zylon:privategpt:*:*:*:*:*:*:*:*"],"vendor":"Zylon","modules":["URI Artifact Loader"],"product":"PrivateGPT","versions":[{"status":"affected","version":"1.0.0"},{"status":"affected","version":"1.0.1"}]}],"modified":"2026-10-25T02:15:12.758Z","provider":"cve","references":["https://vuldb.com/vuln/426100","https://vuldb.com/vuln/426100/cti","https://vuldb.com/cve/CVE-2026-116000","https://vuldb.com/submit/992813","https://github.com/zylon-ai/private-gpt/security/advisories/GHSA-8294-hj7x-42g2","https://github.com/zylon-ai/private-gpt/issues/2269"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T02:15:12.758Z"}}},"related_cves":[{"value":"CVE-2026-116000","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:052aaa0a-7410-45ed-910f-827a96982212","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116000","advisory_id":"052aaa0a-7410-45ed-910f-827a96982212","event_types":["advisory"],"published_at":"2026-10-25T19:36:33.252971+00:00","technologies":["core-cve","privategpt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T02:15:12.758+00:00","detail_url":"/advisories/advisory%3A052aaa0a-7410-45ed-910f-827a96982212","group":{"id":"advisory:052aaa0a-7410-45ed-910f-827a96982212","revision":1,"primary_event_id":62959,"change":"published","superseded_by":[],"changed":{"id":62959,"cve_ids":["CVE-2026-116000"],"payload":{"kind":"advisory","title":"Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery","summary":"A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116000","products":[{"name":{"value":"PrivateGPT","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116000","aliases":["CVE-2026-116000"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:zylon:privategpt:*:*:*:*:*:*:*:*"],"vendor":"Zylon","modules":["URI Artifact Loader"],"product":"PrivateGPT","versions":[{"status":"affected","version":"1.0.0"},{"status":"affected","version":"1.0.1"}]}],"modified":"2026-10-25T02:15:12.758Z","provider":"cve","references":["https://vuldb.com/vuln/426100","https://vuldb.com/vuln/426100/cti","https://vuldb.com/cve/CVE-2026-116000","https://vuldb.com/submit/992813","https://github.com/zylon-ai/private-gpt/security/advisories/GHSA-8294-hj7x-42g2","https://github.com/zylon-ai/private-gpt/issues/2269"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T02:15:12.758Z"}}},"related_cves":[{"value":"CVE-2026-116000","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:052aaa0a-7410-45ed-910f-827a96982212","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116000","advisory_id":"052aaa0a-7410-45ed-910f-827a96982212","event_types":["advisory"],"published_at":"2026-10-25T19:36:33.252971+00:00","technologies":["core-cve","privategpt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T02:15:12.758+00:00","detail_url":"/events/62959"},"members":[{"id":62959,"cve_ids":["CVE-2026-116000"],"payload":{"kind":"advisory","title":"Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery","summary":"A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116000","products":[{"name":{"value":"PrivateGPT","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-116000","aliases":["CVE-2026-116000"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:zylon:privategpt:*:*:*:*:*:*:*:*"],"vendor":"Zylon","modules":["URI Artifact Loader"],"product":"PrivateGPT","versions":[{"status":"affected","version":"1.0.0"},{"status":"affected","version":"1.0.1"}]}],"modified":"2026-10-25T02:15:12.758Z","provider":"cve","references":["https://vuldb.com/vuln/426100","https://vuldb.com/vuln/426100/cti","https://vuldb.com/cve/CVE-2026-116000","https://vuldb.com/submit/992813","https://github.com/zylon-ai/private-gpt/security/advisories/GHSA-8294-hj7x-42g2","https://github.com/zylon-ai/private-gpt/issues/2269"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T02:15:12.758Z"}}},"related_cves":[{"value":"CVE-2026-116000","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:052aaa0a-7410-45ed-910f-827a96982212","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116000","advisory_id":"052aaa0a-7410-45ed-910f-827a96982212","event_types":["advisory"],"published_at":"2026-10-25T19:36:33.252971+00:00","technologies":["core-cve","privategpt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T02:15:12.758+00:00","detail_url":"/events/62959"}]}},{"id":63680,"cve_ids":["CVE-2026-116004"],"payload":{"kind":"advisory","title":"onyx-dot-app Onyx PreviewTab.tsx cross site scripting","summary":"A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116004","products":[{"name":{"value":"Onyx","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116004","aliases":["CVE-2026-116004"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*"],"vendor":"onyx-dot-app","product":"Onyx","versions":[{"status":"affected","version":"5.0"}]}],"modified":"2026-10-25T02:30:20.707Z","provider":"cve","references":["https://vuldb.com/vuln/426102","https://vuldb.com/vuln/426102/cti","https://vuldb.com/cve/CVE-2026-116004","https://vuldb.com/submit/992835","https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-grhq-88h5-2h86","https://github.com/onyx-dot-app/onyx/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T02:30:20.707Z"}}},"related_cves":[{"value":"CVE-2026-116004","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a93c7569-570a-4bad-b348-48b482d66ff5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116004","advisory_id":"a93c7569-570a-4bad-b348-48b482d66ff5","event_types":["advisory"],"published_at":"2026-10-25T19:36:31.649479+00:00","technologies":["core-cve","onyx"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T02:30:20.707+00:00","detail_url":"/advisories/advisory%3Aa93c7569-570a-4bad-b348-48b482d66ff5","group":{"id":"advisory:a93c7569-570a-4bad-b348-48b482d66ff5","revision":1,"primary_event_id":62957,"change":"published","superseded_by":[],"changed":{"id":62957,"cve_ids":["CVE-2026-116004"],"payload":{"kind":"advisory","title":"onyx-dot-app Onyx PreviewTab.tsx cross site scripting","summary":"A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116004","products":[{"name":{"value":"Onyx","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116004","aliases":["CVE-2026-116004"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*"],"vendor":"onyx-dot-app","product":"Onyx","versions":[{"status":"affected","version":"5.0"}]}],"modified":"2026-10-25T02:30:20.707Z","provider":"cve","references":["https://vuldb.com/vuln/426102","https://vuldb.com/vuln/426102/cti","https://vuldb.com/cve/CVE-2026-116004","https://vuldb.com/submit/992835","https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-grhq-88h5-2h86","https://github.com/onyx-dot-app/onyx/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T02:30:20.707Z"}}},"related_cves":[{"value":"CVE-2026-116004","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a93c7569-570a-4bad-b348-48b482d66ff5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116004","advisory_id":"a93c7569-570a-4bad-b348-48b482d66ff5","event_types":["advisory"],"published_at":"2026-10-25T19:36:31.649479+00:00","technologies":["core-cve","onyx"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T02:30:20.707+00:00","detail_url":"/events/62957"},"members":[{"id":62957,"cve_ids":["CVE-2026-116004"],"payload":{"kind":"advisory","title":"onyx-dot-app Onyx PreviewTab.tsx cross site scripting","summary":"A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","evidence":"cve:CVE-2026-116004","products":[{"name":{"value":"Onyx","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-116004","aliases":["CVE-2026-116004"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*"],"vendor":"onyx-dot-app","product":"Onyx","versions":[{"status":"affected","version":"5.0"}]}],"modified":"2026-10-25T02:30:20.707Z","provider":"cve","references":["https://vuldb.com/vuln/426102","https://vuldb.com/vuln/426102/cti","https://vuldb.com/cve/CVE-2026-116004","https://vuldb.com/submit/992835","https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-grhq-88h5-2h86","https://github.com/onyx-dot-app/onyx/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-25T02:30:20.707Z"}}},"related_cves":[{"value":"CVE-2026-116004","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a93c7569-570a-4bad-b348-48b482d66ff5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116004","advisory_id":"a93c7569-570a-4bad-b348-48b482d66ff5","event_types":["advisory"],"published_at":"2026-10-25T19:36:31.649479+00:00","technologies":["core-cve","onyx"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-25T02:30:20.707+00:00","detail_url":"/events/62957"}]}},{"id":63312,"cve_ids":["CVE-2026-102273"],"payload":{"kind":"advisory","title":"PyJWT accepts public JWK containers as HMAC secrets","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102273","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102273","aliases":["CVE-2026-102273"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T13:44:49.200Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w","https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102273","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T13:39:56.542639Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T13:44:49.200Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:38:28.161Z"}}},"related_cves":[{"value":"CVE-2026-102273","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64127b17-8234-4bb3-9c4d-ccf38db74ef8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102273","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-w2cx-738m-mc7w","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102273","advisory_id":"64127b17-8234-4bb3-9c4d-ccf38db74ef8","event_types":["advisory"],"published_at":"2026-10-25T19:30:19.115856+00:00","technologies":["core-cve","pyjwt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T20:38:28.161+00:00","detail_url":"/advisories/advisory%3A64127b17-8234-4bb3-9c4d-ccf38db74ef8","group":{"id":"advisory:64127b17-8234-4bb3-9c4d-ccf38db74ef8","revision":1,"primary_event_id":62597,"change":"published","superseded_by":[],"changed":{"id":62597,"cve_ids":["CVE-2026-102273"],"payload":{"kind":"advisory","title":"PyJWT accepts public JWK containers as HMAC secrets","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102273","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102273","aliases":["CVE-2026-102273"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T13:44:49.200Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w","https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102273","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T13:39:56.542639Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T13:44:49.200Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:38:28.161Z"}}},"related_cves":[{"value":"CVE-2026-102273","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64127b17-8234-4bb3-9c4d-ccf38db74ef8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102273","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-w2cx-738m-mc7w","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102273","advisory_id":"64127b17-8234-4bb3-9c4d-ccf38db74ef8","event_types":["advisory"],"published_at":"2026-10-25T19:30:19.115856+00:00","technologies":["core-cve","pyjwt"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-28T20:38:28.161+00:00","detail_url":"/events/62597"},"members":[{"id":62597,"cve_ids":["CVE-2026-102273"],"payload":{"kind":"advisory","title":"PyJWT accepts public JWK containers as HMAC secrets","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102273","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102273","aliases":["CVE-2026-102273"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T13:44:49.200Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w","https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102273","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T13:39:56.542639Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T13:44:49.200Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:38:28.161Z"}}},"related_cves":[{"value":"CVE-2026-102273","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:64127b17-8234-4bb3-9c4d-ccf38db74ef8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102273","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-w2cx-738m-mc7w","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102273","advisory_id":"64127b17-8234-4bb3-9c4d-ccf38db74ef8","event_types":["advisory"],"published_at":"2026-10-25T19:30:19.115856+00:00","technologies":["core-cve","pyjwt"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-28T20:38:28.161+00:00","detail_url":"/events/62597"}]}},{"id":63305,"cve_ids":["CVE-2026-102831"],"payload":{"kind":"advisory","title":"JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard","summary":"JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.","evidence":"cve:CVE-2026-102831","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"notebook","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"jupyterlite-core","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102831","aliases":["CVE-2026-102831"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":">= 4.5.0, < 4.5.11"},{"status":"affected","version":">= 4.6.0, < 4.6.4"}]},{"vendor":"jupyterlab","product":"notebook","versions":[{"status":"affected","version":">= 7.5.0, < 7.6.3"}]},{"vendor":"jupyterlab","product":"jupyterlite-core","versions":[{"status":"affected","version":">= 0.7.0, < 0.8.4"}]}],"modified":"2026-10-02T12:22:58.664Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv","https://github.com/jupyterlab/jupyterlab/commit/1a10a7da5ff655849b21581c2633b46483ae0be9","https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96","https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102831","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T12:22:47.366494Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T12:22:58.664Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T18:58:03.634Z"}}},"related_cves":[{"value":"CVE-2026-102831","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:06a55e6c-2adb-42d9-ba76-6f2de535d8af","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102831","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"jupyterlab","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.6.4","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.6.0","evidence":"/affected/0/versions"},{"value":"4.6.1","evidence":"/affected/0/versions"},{"value":"4.6.2","evidence":"/affected/0/versions"},{"value":"4.6.3","evidence":"/affected/0/versions"}]},{"name":{"value":"jupyterlab","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.11","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"4.5.0","evidence":"/affected/1/versions"},{"value":"4.5.1","evidence":"/affected/1/versions"},{"value":"4.5.10","evidence":"/affected/1/versions"},{"value":"4.5.2","evidence":"/affected/1/versions"},{"value":"4.5.3","evidence":"/affected/1/versions"},{"value":"4.5.4","evidence":"/affected/1/versions"},{"value":"4.5.5","evidence":"/affected/1/versions"},{"value":"4.5.6","evidence":"/affected/1/versions"},{"value":"4.5.7","evidence":"/affected/1/versions"},{"value":"4.5.8","evidence":"/affected/1/versions"},{"value":"4.5.9","evidence":"/affected/1/versions"}]},{"name":{"value":"notebook","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"7.5.0","evidence":"/affected/2/versions"},{"value":"7.5.1","evidence":"/affected/2/versions"},{"value":"7.5.2","evidence":"/affected/2/versions"},{"value":"7.5.3","evidence":"/affected/2/versions"},{"value":"7.5.4","evidence":"/affected/2/versions"},{"value":"7.5.5","evidence":"/affected/2/versions"},{"value":"7.5.6","evidence":"/affected/2/versions"},{"value":"7.5.7","evidence":"/affected/2/versions"},{"value":"7.6.0","evidence":"/affected/2/versions"},{"value":"7.6.0a0","evidence":"/affected/2/versions"},{"value":"7.6.0a1","evidence":"/affected/2/versions"},{"value":"7.6.0a2","evidence":"/affected/2/versions"},{"value":"7.6.0a3","evidence":"/affected/2/versions"},{"value":"7.6.0a4","evidence":"/affected/2/versions"},{"value":"7.6.0a5","evidence":"/affected/2/versions"},{"value":"7.6.0b0","evidence":"/affected/2/versions"},{"value":"7.6.0b1","evidence":"/affected/2/versions"},{"value":"7.6.0rc0","evidence":"/affected/2/versions"},{"value":"7.6.0rc1","evidence":"/affected/2/versions"},{"value":"7.6.1","evidence":"/affected/2/versions"},{"value":"7.6.2","evidence":"/affected/2/versions"}]},{"name":{"value":"jupyterlite","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"0.7.0","evidence":"/affected/3/versions"},{"value":"0.7.1","evidence":"/affected/3/versions"},{"value":"0.7.2","evidence":"/affected/3/versions"},{"value":"0.7.3","evidence":"/affected/3/versions"},{"value":"0.7.4","evidence":"/affected/3/versions"},{"value":"0.7.5","evidence":"/affected/3/versions"},{"value":"0.7.6","evidence":"/affected/3/versions"},{"value":"0.8.0","evidence":"/affected/3/versions"},{"value":"0.8.0a0","evidence":"/affected/3/versions"},{"value":"0.8.0a1","evidence":"/affected/3/versions"},{"value":"0.8.0a2","evidence":"/affected/3/versions"},{"value":"0.8.0b0","evidence":"/affected/3/versions"},{"value":"0.8.0b1","evidence":"/affected/3/versions"},{"value":"0.8.0rc0","evidence":"/affected/3/versions"},{"value":"0.8.1","evidence":"/affected/3/versions"},{"value":"0.8.2","evidence":"/affected/3/versions"},{"value":"0.8.3","evidence":"/affected/3/versions"}]},{"name":{"value":"jupyterlite-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"0.7.0","evidence":"/affected/4/versions"},{"value":"0.7.1","evidence":"/affected/4/versions"},{"value":"0.7.2","evidence":"/affected/4/versions"},{"value":"0.7.3","evidence":"/affected/4/versions"},{"value":"0.7.4","evidence":"/affected/4/versions"},{"value":"0.7.5","evidence":"/affected/4/versions"},{"value":"0.7.6","evidence":"/affected/4/versions"},{"value":"0.8.0","evidence":"/affected/4/versions"},{"value":"0.8.0a0","evidence":"/affected/4/versions"},{"value":"0.8.0a1","evidence":"/affected/4/versions"},{"value":"0.8.0a2","evidence":"/affected/4/versions"},{"value":"0.8.0b0","evidence":"/affected/4/versions"},{"value":"0.8.0b1","evidence":"/affected/4/versions"},{"value":"0.8.0rc0","evidence":"/affected/4/versions"},{"value":"0.8.1","evidence":"/affected/4/versions"},{"value":"0.8.2","evidence":"/affected/4/versions"},{"value":"0.8.3","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6966-vjj6-99xv","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102831","advisory_id":"06a55e6c-2adb-42d9-ba76-6f2de535d8af","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.953907+00:00","technologies":["core-cve","jupyterlab","jupyterlite-core","notebook"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T18:58:03.634+00:00","detail_url":"/advisories/advisory%3A06a55e6c-2adb-42d9-ba76-6f2de535d8af","group":{"id":"advisory:06a55e6c-2adb-42d9-ba76-6f2de535d8af","revision":1,"primary_event_id":62590,"change":"published","superseded_by":[],"changed":{"id":62590,"cve_ids":["CVE-2026-102831"],"payload":{"kind":"advisory","title":"JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard","summary":"JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.","evidence":"cve:CVE-2026-102831","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"notebook","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"jupyterlite-core","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102831","aliases":["CVE-2026-102831"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":">= 4.5.0, < 4.5.11"},{"status":"affected","version":">= 4.6.0, < 4.6.4"}]},{"vendor":"jupyterlab","product":"notebook","versions":[{"status":"affected","version":">= 7.5.0, < 7.6.3"}]},{"vendor":"jupyterlab","product":"jupyterlite-core","versions":[{"status":"affected","version":">= 0.7.0, < 0.8.4"}]}],"modified":"2026-10-02T12:22:58.664Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv","https://github.com/jupyterlab/jupyterlab/commit/1a10a7da5ff655849b21581c2633b46483ae0be9","https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96","https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102831","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T12:22:47.366494Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T12:22:58.664Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T18:58:03.634Z"}}},"related_cves":[{"value":"CVE-2026-102831","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:06a55e6c-2adb-42d9-ba76-6f2de535d8af","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102831","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"jupyterlab","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.6.4","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.6.0","evidence":"/affected/0/versions"},{"value":"4.6.1","evidence":"/affected/0/versions"},{"value":"4.6.2","evidence":"/affected/0/versions"},{"value":"4.6.3","evidence":"/affected/0/versions"}]},{"name":{"value":"jupyterlab","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.11","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"4.5.0","evidence":"/affected/1/versions"},{"value":"4.5.1","evidence":"/affected/1/versions"},{"value":"4.5.10","evidence":"/affected/1/versions"},{"value":"4.5.2","evidence":"/affected/1/versions"},{"value":"4.5.3","evidence":"/affected/1/versions"},{"value":"4.5.4","evidence":"/affected/1/versions"},{"value":"4.5.5","evidence":"/affected/1/versions"},{"value":"4.5.6","evidence":"/affected/1/versions"},{"value":"4.5.7","evidence":"/affected/1/versions"},{"value":"4.5.8","evidence":"/affected/1/versions"},{"value":"4.5.9","evidence":"/affected/1/versions"}]},{"name":{"value":"notebook","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"7.5.0","evidence":"/affected/2/versions"},{"value":"7.5.1","evidence":"/affected/2/versions"},{"value":"7.5.2","evidence":"/affected/2/versions"},{"value":"7.5.3","evidence":"/affected/2/versions"},{"value":"7.5.4","evidence":"/affected/2/versions"},{"value":"7.5.5","evidence":"/affected/2/versions"},{"value":"7.5.6","evidence":"/affected/2/versions"},{"value":"7.5.7","evidence":"/affected/2/versions"},{"value":"7.6.0","evidence":"/affected/2/versions"},{"value":"7.6.0a0","evidence":"/affected/2/versions"},{"value":"7.6.0a1","evidence":"/affected/2/versions"},{"value":"7.6.0a2","evidence":"/affected/2/versions"},{"value":"7.6.0a3","evidence":"/affected/2/versions"},{"value":"7.6.0a4","evidence":"/affected/2/versions"},{"value":"7.6.0a5","evidence":"/affected/2/versions"},{"value":"7.6.0b0","evidence":"/affected/2/versions"},{"value":"7.6.0b1","evidence":"/affected/2/versions"},{"value":"7.6.0rc0","evidence":"/affected/2/versions"},{"value":"7.6.0rc1","evidence":"/affected/2/versions"},{"value":"7.6.1","evidence":"/affected/2/versions"},{"value":"7.6.2","evidence":"/affected/2/versions"}]},{"name":{"value":"jupyterlite","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"0.7.0","evidence":"/affected/3/versions"},{"value":"0.7.1","evidence":"/affected/3/versions"},{"value":"0.7.2","evidence":"/affected/3/versions"},{"value":"0.7.3","evidence":"/affected/3/versions"},{"value":"0.7.4","evidence":"/affected/3/versions"},{"value":"0.7.5","evidence":"/affected/3/versions"},{"value":"0.7.6","evidence":"/affected/3/versions"},{"value":"0.8.0","evidence":"/affected/3/versions"},{"value":"0.8.0a0","evidence":"/affected/3/versions"},{"value":"0.8.0a1","evidence":"/affected/3/versions"},{"value":"0.8.0a2","evidence":"/affected/3/versions"},{"value":"0.8.0b0","evidence":"/affected/3/versions"},{"value":"0.8.0b1","evidence":"/affected/3/versions"},{"value":"0.8.0rc0","evidence":"/affected/3/versions"},{"value":"0.8.1","evidence":"/affected/3/versions"},{"value":"0.8.2","evidence":"/affected/3/versions"},{"value":"0.8.3","evidence":"/affected/3/versions"}]},{"name":{"value":"jupyterlite-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"0.7.0","evidence":"/affected/4/versions"},{"value":"0.7.1","evidence":"/affected/4/versions"},{"value":"0.7.2","evidence":"/affected/4/versions"},{"value":"0.7.3","evidence":"/affected/4/versions"},{"value":"0.7.4","evidence":"/affected/4/versions"},{"value":"0.7.5","evidence":"/affected/4/versions"},{"value":"0.7.6","evidence":"/affected/4/versions"},{"value":"0.8.0","evidence":"/affected/4/versions"},{"value":"0.8.0a0","evidence":"/affected/4/versions"},{"value":"0.8.0a1","evidence":"/affected/4/versions"},{"value":"0.8.0a2","evidence":"/affected/4/versions"},{"value":"0.8.0b0","evidence":"/affected/4/versions"},{"value":"0.8.0b1","evidence":"/affected/4/versions"},{"value":"0.8.0rc0","evidence":"/affected/4/versions"},{"value":"0.8.1","evidence":"/affected/4/versions"},{"value":"0.8.2","evidence":"/affected/4/versions"},{"value":"0.8.3","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6966-vjj6-99xv","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102831","advisory_id":"06a55e6c-2adb-42d9-ba76-6f2de535d8af","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.953907+00:00","technologies":["core-cve","jupyterlab","jupyterlite-core","notebook"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-29T18:58:03.634+00:00","detail_url":"/events/62590"},"members":[{"id":62590,"cve_ids":["CVE-2026-102831"],"payload":{"kind":"advisory","title":"JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard","summary":"JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.","evidence":"cve:CVE-2026-102831","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"notebook","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"jupyterlite-core","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102831","aliases":["CVE-2026-102831"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":">= 4.5.0, < 4.5.11"},{"status":"affected","version":">= 4.6.0, < 4.6.4"}]},{"vendor":"jupyterlab","product":"notebook","versions":[{"status":"affected","version":">= 7.5.0, < 7.6.3"}]},{"vendor":"jupyterlab","product":"jupyterlite-core","versions":[{"status":"affected","version":">= 0.7.0, < 0.8.4"}]}],"modified":"2026-10-02T12:22:58.664Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv","https://github.com/jupyterlab/jupyterlab/commit/1a10a7da5ff655849b21581c2633b46483ae0be9","https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96","https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102831","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T12:22:47.366494Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T12:22:58.664Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T18:58:03.634Z"}}},"related_cves":[{"value":"CVE-2026-102831","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:06a55e6c-2adb-42d9-ba76-6f2de535d8af","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102831","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"jupyterlab","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.6.4","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.6.0","evidence":"/affected/0/versions"},{"value":"4.6.1","evidence":"/affected/0/versions"},{"value":"4.6.2","evidence":"/affected/0/versions"},{"value":"4.6.3","evidence":"/affected/0/versions"}]},{"name":{"value":"jupyterlab","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.5.11","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"4.5.0","evidence":"/affected/1/versions"},{"value":"4.5.1","evidence":"/affected/1/versions"},{"value":"4.5.10","evidence":"/affected/1/versions"},{"value":"4.5.2","evidence":"/affected/1/versions"},{"value":"4.5.3","evidence":"/affected/1/versions"},{"value":"4.5.4","evidence":"/affected/1/versions"},{"value":"4.5.5","evidence":"/affected/1/versions"},{"value":"4.5.6","evidence":"/affected/1/versions"},{"value":"4.5.7","evidence":"/affected/1/versions"},{"value":"4.5.8","evidence":"/affected/1/versions"},{"value":"4.5.9","evidence":"/affected/1/versions"}]},{"name":{"value":"notebook","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"7.5.0","evidence":"/affected/2/versions"},{"value":"7.5.1","evidence":"/affected/2/versions"},{"value":"7.5.2","evidence":"/affected/2/versions"},{"value":"7.5.3","evidence":"/affected/2/versions"},{"value":"7.5.4","evidence":"/affected/2/versions"},{"value":"7.5.5","evidence":"/affected/2/versions"},{"value":"7.5.6","evidence":"/affected/2/versions"},{"value":"7.5.7","evidence":"/affected/2/versions"},{"value":"7.6.0","evidence":"/affected/2/versions"},{"value":"7.6.0a0","evidence":"/affected/2/versions"},{"value":"7.6.0a1","evidence":"/affected/2/versions"},{"value":"7.6.0a2","evidence":"/affected/2/versions"},{"value":"7.6.0a3","evidence":"/affected/2/versions"},{"value":"7.6.0a4","evidence":"/affected/2/versions"},{"value":"7.6.0a5","evidence":"/affected/2/versions"},{"value":"7.6.0b0","evidence":"/affected/2/versions"},{"value":"7.6.0b1","evidence":"/affected/2/versions"},{"value":"7.6.0rc0","evidence":"/affected/2/versions"},{"value":"7.6.0rc1","evidence":"/affected/2/versions"},{"value":"7.6.1","evidence":"/affected/2/versions"},{"value":"7.6.2","evidence":"/affected/2/versions"}]},{"name":{"value":"jupyterlite","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"0.7.0","evidence":"/affected/3/versions"},{"value":"0.7.1","evidence":"/affected/3/versions"},{"value":"0.7.2","evidence":"/affected/3/versions"},{"value":"0.7.3","evidence":"/affected/3/versions"},{"value":"0.7.4","evidence":"/affected/3/versions"},{"value":"0.7.5","evidence":"/affected/3/versions"},{"value":"0.7.6","evidence":"/affected/3/versions"},{"value":"0.8.0","evidence":"/affected/3/versions"},{"value":"0.8.0a0","evidence":"/affected/3/versions"},{"value":"0.8.0a1","evidence":"/affected/3/versions"},{"value":"0.8.0a2","evidence":"/affected/3/versions"},{"value":"0.8.0b0","evidence":"/affected/3/versions"},{"value":"0.8.0b1","evidence":"/affected/3/versions"},{"value":"0.8.0rc0","evidence":"/affected/3/versions"},{"value":"0.8.1","evidence":"/affected/3/versions"},{"value":"0.8.2","evidence":"/affected/3/versions"},{"value":"0.8.3","evidence":"/affected/3/versions"}]},{"name":{"value":"jupyterlite-core","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.4","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"0.7.0","evidence":"/affected/4/versions"},{"value":"0.7.1","evidence":"/affected/4/versions"},{"value":"0.7.2","evidence":"/affected/4/versions"},{"value":"0.7.3","evidence":"/affected/4/versions"},{"value":"0.7.4","evidence":"/affected/4/versions"},{"value":"0.7.5","evidence":"/affected/4/versions"},{"value":"0.7.6","evidence":"/affected/4/versions"},{"value":"0.8.0","evidence":"/affected/4/versions"},{"value":"0.8.0a0","evidence":"/affected/4/versions"},{"value":"0.8.0a1","evidence":"/affected/4/versions"},{"value":"0.8.0a2","evidence":"/affected/4/versions"},{"value":"0.8.0b0","evidence":"/affected/4/versions"},{"value":"0.8.0b1","evidence":"/affected/4/versions"},{"value":"0.8.0rc0","evidence":"/affected/4/versions"},{"value":"0.8.1","evidence":"/affected/4/versions"},{"value":"0.8.2","evidence":"/affected/4/versions"},{"value":"0.8.3","evidence":"/affected/4/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6966-vjj6-99xv","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102831","advisory_id":"06a55e6c-2adb-42d9-ba76-6f2de535d8af","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.953907+00:00","technologies":["core-cve","jupyterlab","jupyterlite-core","notebook"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-29T18:58:03.634+00:00","detail_url":"/events/62590"}]}},{"id":63303,"cve_ids":["CVE-2026-57443"],"payload":{"kind":"advisory","title":"SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests","summary":"SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=[\"*\"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.","evidence":"cve:CVE-2026-57443","products":[{"name":{"value":"SCBE-AETHERMOORE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-57443","aliases":["CVE-2026-57443"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"issdandavis","product":"SCBE-AETHERMOORE","versions":[{"status":"affected","version":">= 4.0.2, < 4.2.1"}]}],"modified":"2026-09-29T17:45:46.289Z","provider":"cve","references":["https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57443","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:44:13.690659Z"}}}],"references":[{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:45:46.289Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T20:37:52.116Z"}}},"related_cves":[{"value":"CVE-2026-57443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85bbd35a-0690-4462-9ff2-668b42ab65d8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-57443","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"products":[{"name":{"value":"scbe-aethermoore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.1.3","evidence":"/affected/0/versions"},{"value":"4.2.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q986-4x7x-gx39","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57443","advisory_id":"85bbd35a-0690-4462-9ff2-668b42ab65d8","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.234456+00:00","technologies":["core-cve","scbe-aethermoore"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T20:37:52.116+00:00","detail_url":"/advisories/advisory%3A85bbd35a-0690-4462-9ff2-668b42ab65d8","group":{"id":"advisory:85bbd35a-0690-4462-9ff2-668b42ab65d8","revision":1,"primary_event_id":62587,"change":"published","superseded_by":[],"changed":{"id":62587,"cve_ids":["CVE-2026-57443"],"payload":{"kind":"advisory","title":"SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests","summary":"SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=[\"*\"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.","evidence":"cve:CVE-2026-57443","products":[{"name":{"value":"SCBE-AETHERMOORE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-57443","aliases":["CVE-2026-57443"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"issdandavis","product":"SCBE-AETHERMOORE","versions":[{"status":"affected","version":">= 4.0.2, < 4.2.1"}]}],"modified":"2026-09-29T17:45:46.289Z","provider":"cve","references":["https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57443","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:44:13.690659Z"}}}],"references":[{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:45:46.289Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T20:37:52.116Z"}}},"related_cves":[{"value":"CVE-2026-57443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85bbd35a-0690-4462-9ff2-668b42ab65d8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-57443","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"products":[{"name":{"value":"scbe-aethermoore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.1.3","evidence":"/affected/0/versions"},{"value":"4.2.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q986-4x7x-gx39","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57443","advisory_id":"85bbd35a-0690-4462-9ff2-668b42ab65d8","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.234456+00:00","technologies":["core-cve","scbe-aethermoore"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-25T20:37:52.116+00:00","detail_url":"/events/62587"},"members":[{"id":62587,"cve_ids":["CVE-2026-57443"],"payload":{"kind":"advisory","title":"SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests","summary":"SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=[\"*\"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.","evidence":"cve:CVE-2026-57443","products":[{"name":{"value":"SCBE-AETHERMOORE","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-57443","aliases":["CVE-2026-57443"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"issdandavis","product":"SCBE-AETHERMOORE","versions":[{"status":"affected","version":">= 4.0.2, < 4.2.1"}]}],"modified":"2026-09-29T17:45:46.289Z","provider":"cve","references":["https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e","https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-57443","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:44:13.690659Z"}}}],"references":[{"url":"https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:45:46.289Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-25T20:37:52.116Z"}}},"related_cves":[{"value":"CVE-2026-57443","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85bbd35a-0690-4462-9ff2-668b42ab65d8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-57443","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"products":[{"name":{"value":"scbe-aethermoore","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.1.3","evidence":"/affected/0/versions"},{"value":"4.2.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-q986-4x7x-gx39","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57443","advisory_id":"85bbd35a-0690-4462-9ff2-668b42ab65d8","event_types":["advisory"],"published_at":"2026-10-25T19:29:28.234456+00:00","technologies":["core-cve","scbe-aethermoore"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-25T20:37:52.116+00:00","detail_url":"/events/62587"}]}},{"id":63299,"cve_ids":["CVE-2026-63349"],"payload":{"kind":"advisory","title":"AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups","summary":"AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.","evidence":"cve:CVE-2026-63349","products":[{"name":{"value":"anyio","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63349","aliases":["CVE-2026-63349"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"agronholm","product":"anyio","versions":[{"status":"affected","version":">= 4.14.0, < 4.14.2"}]}],"modified":"2026-09-24T21:05:25.977Z","provider":"cve","references":["https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26","https://github.com/agronholm/anyio/pull/1209","https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200","https://github.com/agronholm/anyio/releases/tag/4.14.2"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63349","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T21:00:28.848164Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T21:05:25.977Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-18T17:02:30.273Z"}}},"related_cves":[{"value":"CVE-2026-63349","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6f235ef0-fe2b-4801-9f47-a34283085248","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-63349","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"anyio","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.2","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.14.0","evidence":"/affected/0/versions"},{"value":"4.14.1","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3w57-8xmc-8v26","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63349","advisory_id":"6f235ef0-fe2b-4801-9f47-a34283085248","event_types":["advisory"],"published_at":"2026-10-25T19:29:25.771544+00:00","technologies":["anyio","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T17:02:30.273+00:00","detail_url":"/advisories/advisory%3A6f235ef0-fe2b-4801-9f47-a34283085248","group":{"id":"advisory:6f235ef0-fe2b-4801-9f47-a34283085248","revision":1,"primary_event_id":62580,"change":"published","superseded_by":[],"changed":{"id":62580,"cve_ids":["CVE-2026-63349"],"payload":{"kind":"advisory","title":"AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups","summary":"AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.","evidence":"cve:CVE-2026-63349","products":[{"name":{"value":"anyio","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63349","aliases":["CVE-2026-63349"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"agronholm","product":"anyio","versions":[{"status":"affected","version":">= 4.14.0, < 4.14.2"}]}],"modified":"2026-09-24T21:05:25.977Z","provider":"cve","references":["https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26","https://github.com/agronholm/anyio/pull/1209","https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200","https://github.com/agronholm/anyio/releases/tag/4.14.2"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63349","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T21:00:28.848164Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T21:05:25.977Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-18T17:02:30.273Z"}}},"related_cves":[{"value":"CVE-2026-63349","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6f235ef0-fe2b-4801-9f47-a34283085248","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-63349","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"anyio","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.2","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.14.0","evidence":"/affected/0/versions"},{"value":"4.14.1","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3w57-8xmc-8v26","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63349","advisory_id":"6f235ef0-fe2b-4801-9f47-a34283085248","event_types":["advisory"],"published_at":"2026-10-25T19:29:25.771544+00:00","technologies":["anyio","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-18T17:02:30.273+00:00","detail_url":"/events/62580"},"members":[{"id":62580,"cve_ids":["CVE-2026-63349"],"payload":{"kind":"advisory","title":"AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups","summary":"AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.","evidence":"cve:CVE-2026-63349","products":[{"name":{"value":"anyio","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63349","aliases":["CVE-2026-63349"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"agronholm","product":"anyio","versions":[{"status":"affected","version":">= 4.14.0, < 4.14.2"}]}],"modified":"2026-09-24T21:05:25.977Z","provider":"cve","references":["https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26","https://github.com/agronholm/anyio/pull/1209","https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200","https://github.com/agronholm/anyio/releases/tag/4.14.2"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63349","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T21:00:28.848164Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T21:05:25.977Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-18T17:02:30.273Z"}}},"related_cves":[{"value":"CVE-2026-63349","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6f235ef0-fe2b-4801-9f47-a34283085248","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-63349","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"anyio","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.14.2","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"4.14.0","evidence":"/affected/0/versions"},{"value":"4.14.1","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-3w57-8xmc-8v26","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63349","advisory_id":"6f235ef0-fe2b-4801-9f47-a34283085248","event_types":["advisory"],"published_at":"2026-10-25T19:29:25.771544+00:00","technologies":["anyio","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-18T17:02:30.273+00:00","detail_url":"/events/62580"}]}},{"id":63295,"cve_ids":["CVE-2026-102272"],"payload":{"kind":"advisory","title":"PyJWT BOM Bypass","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102272","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102272","aliases":["CVE-2026-102272"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T14:45:44.138Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947","https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102272","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T14:45:38.333972Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T14:45:44.138Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:36:31.530Z"}}},"related_cves":[{"value":"CVE-2026-102272","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d018cf8b-b677-43d0-9e9f-bae90be94b3a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102272","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-r6x4-923q-g947","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102272","advisory_id":"d018cf8b-b677-43d0-9e9f-bae90be94b3a","event_types":["advisory"],"published_at":"2026-10-25T19:29:20.015214+00:00","technologies":["core-cve","pyjwt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T20:36:31.53+00:00","detail_url":"/advisories/advisory%3Ad018cf8b-b677-43d0-9e9f-bae90be94b3a","group":{"id":"advisory:d018cf8b-b677-43d0-9e9f-bae90be94b3a","revision":1,"primary_event_id":62569,"change":"published","superseded_by":[],"changed":{"id":62569,"cve_ids":["CVE-2026-102272"],"payload":{"kind":"advisory","title":"PyJWT BOM Bypass","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102272","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102272","aliases":["CVE-2026-102272"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T14:45:44.138Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947","https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102272","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T14:45:38.333972Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T14:45:44.138Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:36:31.530Z"}}},"related_cves":[{"value":"CVE-2026-102272","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d018cf8b-b677-43d0-9e9f-bae90be94b3a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102272","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-r6x4-923q-g947","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102272","advisory_id":"d018cf8b-b677-43d0-9e9f-bae90be94b3a","event_types":["advisory"],"published_at":"2026-10-25T19:29:20.015214+00:00","technologies":["core-cve","pyjwt"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-28T20:36:31.53+00:00","detail_url":"/events/62569"},"members":[{"id":62569,"cve_ids":["CVE-2026-102272"],"payload":{"kind":"advisory","title":"PyJWT BOM Bypass","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102272","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102272","aliases":["CVE-2026-102272"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T14:45:44.138Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947","https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102272","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T14:45:38.333972Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T14:45:44.138Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:36:31.530Z"}}},"related_cves":[{"value":"CVE-2026-102272","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d018cf8b-b677-43d0-9e9f-bae90be94b3a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102272","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-r6x4-923q-g947","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102272","advisory_id":"d018cf8b-b677-43d0-9e9f-bae90be94b3a","event_types":["advisory"],"published_at":"2026-10-25T19:29:20.015214+00:00","technologies":["core-cve","pyjwt"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-28T20:36:31.53+00:00","detail_url":"/events/62569"}]}},{"id":63293,"cve_ids":["CVE-2026-102266"],"payload":{"kind":"advisory","title":"PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102266","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102266","aliases":["CVE-2026-102266"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T19:35:42.049Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r","https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102266","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T19:28:36.086597Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T19:35:42.049Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:21:26.164Z"}}},"related_cves":[{"value":"CVE-2026-102266","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:967a6685-8d58-4854-9710-f17e42ed33bd","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102266","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9j54-fg26-wv3r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102266","advisory_id":"967a6685-8d58-4854-9710-f17e42ed33bd","event_types":["advisory"],"published_at":"2026-10-25T19:28:30.884633+00:00","technologies":["core-cve","pyjwt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T20:21:26.164+00:00","detail_url":"/advisories/advisory%3A967a6685-8d58-4854-9710-f17e42ed33bd","group":{"id":"advisory:967a6685-8d58-4854-9710-f17e42ed33bd","revision":1,"primary_event_id":62565,"change":"published","superseded_by":[],"changed":{"id":62565,"cve_ids":["CVE-2026-102266"],"payload":{"kind":"advisory","title":"PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102266","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102266","aliases":["CVE-2026-102266"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T19:35:42.049Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r","https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102266","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T19:28:36.086597Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T19:35:42.049Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:21:26.164Z"}}},"related_cves":[{"value":"CVE-2026-102266","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:967a6685-8d58-4854-9710-f17e42ed33bd","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102266","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9j54-fg26-wv3r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102266","advisory_id":"967a6685-8d58-4854-9710-f17e42ed33bd","event_types":["advisory"],"published_at":"2026-10-25T19:28:30.884633+00:00","technologies":["core-cve","pyjwt"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-28T20:21:26.164+00:00","detail_url":"/events/62565"},"members":[{"id":62565,"cve_ids":["CVE-2026-102266"],"payload":{"kind":"advisory","title":"PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102266","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102266","aliases":["CVE-2026-102266"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.13.0, < 2.14.0"}]}],"modified":"2026-09-29T19:35:42.049Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r","https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102266","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T19:28:36.086597Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T19:35:42.049Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:21:26.164Z"}}},"related_cves":[{"value":"CVE-2026-102266","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:967a6685-8d58-4854-9710-f17e42ed33bd","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102266","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-9j54-fg26-wv3r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102266","advisory_id":"967a6685-8d58-4854-9710-f17e42ed33bd","event_types":["advisory"],"published_at":"2026-10-25T19:28:30.884633+00:00","technologies":["core-cve","pyjwt"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-28T20:21:26.164+00:00","detail_url":"/events/62565"}]}},{"id":63284,"cve_ids":["CVE-2026-61732"],"payload":{"kind":"advisory","title":"Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context","summary":"Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.","evidence":"cve:CVE-2026-61732","products":[{"name":{"value":"Decepticon","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"decepticon-core","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"decepticon-sdk","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-61732","aliases":["CVE-2026-61732"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"BitterSecurity","product":"Decepticon","versions":[{"status":"affected","version":"< 1.1.17"}]},{"vendor":"BitterSecurity","product":"decepticon-core","versions":[{"status":"affected","version":"< 1.1.17"}]},{"vendor":"BitterSecurity","product":"decepticon-sdk","versions":[{"status":"affected","version":"< 1.1.17"}]}],"modified":"2026-09-24T18:00:43.383Z","provider":"cve","references":["https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","https://github.com/BitterSecurity/Decepticon/commit/79ee2aaf22f4c36a5b1968f6ca3f8086b6e35b67"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61732","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:59:08.643777Z"}}}],"references":[{"url":"https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T18:00:43.383Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:40:51.248Z"}}},"related_cves":[{"value":"CVE-2026-61732","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9f8b0ee6-8111-4793-b8df-bb3e051dd1da","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-61732","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"decepticon-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"1.1.10","evidence":"/affected/0/versions"},{"value":"1.1.11","evidence":"/affected/0/versions"},{"value":"1.1.12","evidence":"/affected/0/versions"},{"value":"1.1.13","evidence":"/affected/0/versions"},{"value":"1.1.14","evidence":"/affected/0/versions"},{"value":"1.1.15","evidence":"/affected/0/versions"},{"value":"1.1.16","evidence":"/affected/0/versions"},{"value":"1.1.2","evidence":"/affected/0/versions"},{"value":"1.1.3","evidence":"/affected/0/versions"},{"value":"1.1.4","evidence":"/affected/0/versions"},{"value":"1.1.5","evidence":"/affected/0/versions"},{"value":"1.1.6","evidence":"/affected/0/versions"},{"value":"1.1.7","evidence":"/affected/0/versions"},{"value":"1.1.8","evidence":"/affected/0/versions"},{"value":"1.1.9","evidence":"/affected/0/versions"}]},{"name":{"value":"decepticon","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"1.1.0","evidence":"/affected/1/versions"},{"value":"1.1.1","evidence":"/affected/1/versions"},{"value":"1.1.10","evidence":"/affected/1/versions"},{"value":"1.1.11","evidence":"/affected/1/versions"},{"value":"1.1.12","evidence":"/affected/1/versions"},{"value":"1.1.13","evidence":"/affected/1/versions"},{"value":"1.1.14","evidence":"/affected/1/versions"},{"value":"1.1.15","evidence":"/affected/1/versions"},{"value":"1.1.16","evidence":"/affected/1/versions"},{"value":"1.1.2","evidence":"/affected/1/versions"},{"value":"1.1.3","evidence":"/affected/1/versions"},{"value":"1.1.4","evidence":"/affected/1/versions"},{"value":"1.1.5","evidence":"/affected/1/versions"},{"value":"1.1.6","evidence":"/affected/1/versions"},{"value":"1.1.7","evidence":"/affected/1/versions"},{"value":"1.1.8","evidence":"/affected/1/versions"},{"value":"1.1.9","evidence":"/affected/1/versions"}]},{"name":{"value":"decepticon-sdk","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.1.10","evidence":"/affected/2/versions"},{"value":"1.1.11","evidence":"/affected/2/versions"},{"value":"1.1.12","evidence":"/affected/2/versions"},{"value":"1.1.13","evidence":"/affected/2/versions"},{"value":"1.1.14","evidence":"/affected/2/versions"},{"value":"1.1.15","evidence":"/affected/2/versions"},{"value":"1.1.16","evidence":"/affected/2/versions"},{"value":"1.1.2","evidence":"/affected/2/versions"},{"value":"1.1.3","evidence":"/affected/2/versions"},{"value":"1.1.4","evidence":"/affected/2/versions"},{"value":"1.1.5","evidence":"/affected/2/versions"},{"value":"1.1.6","evidence":"/affected/2/versions"},{"value":"1.1.7","evidence":"/affected/2/versions"},{"value":"1.1.8","evidence":"/affected/2/versions"},{"value":"1.1.9","evidence":"/affected/2/versions"}]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-g5f9-3xfg-p9mf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61732","advisory_id":"9f8b0ee6-8111-4793-b8df-bb3e051dd1da","event_types":["advisory"],"published_at":"2026-10-25T19:28:26.416545+00:00","technologies":["core-cve","decepticon","decepticon-core","decepticon-sdk"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T17:40:51.248+00:00","detail_url":"/advisories/advisory%3A9f8b0ee6-8111-4793-b8df-bb3e051dd1da","group":{"id":"advisory:9f8b0ee6-8111-4793-b8df-bb3e051dd1da","revision":1,"primary_event_id":62554,"change":"published","superseded_by":[],"changed":{"id":62554,"cve_ids":["CVE-2026-61732"],"payload":{"kind":"advisory","title":"Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context","summary":"Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.","evidence":"cve:CVE-2026-61732","products":[{"name":{"value":"Decepticon","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"decepticon-core","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"decepticon-sdk","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-61732","aliases":["CVE-2026-61732"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"BitterSecurity","product":"Decepticon","versions":[{"status":"affected","version":"< 1.1.17"}]},{"vendor":"BitterSecurity","product":"decepticon-core","versions":[{"status":"affected","version":"< 1.1.17"}]},{"vendor":"BitterSecurity","product":"decepticon-sdk","versions":[{"status":"affected","version":"< 1.1.17"}]}],"modified":"2026-09-24T18:00:43.383Z","provider":"cve","references":["https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","https://github.com/BitterSecurity/Decepticon/commit/79ee2aaf22f4c36a5b1968f6ca3f8086b6e35b67"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61732","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:59:08.643777Z"}}}],"references":[{"url":"https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T18:00:43.383Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:40:51.248Z"}}},"related_cves":[{"value":"CVE-2026-61732","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9f8b0ee6-8111-4793-b8df-bb3e051dd1da","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-61732","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"decepticon-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"1.1.10","evidence":"/affected/0/versions"},{"value":"1.1.11","evidence":"/affected/0/versions"},{"value":"1.1.12","evidence":"/affected/0/versions"},{"value":"1.1.13","evidence":"/affected/0/versions"},{"value":"1.1.14","evidence":"/affected/0/versions"},{"value":"1.1.15","evidence":"/affected/0/versions"},{"value":"1.1.16","evidence":"/affected/0/versions"},{"value":"1.1.2","evidence":"/affected/0/versions"},{"value":"1.1.3","evidence":"/affected/0/versions"},{"value":"1.1.4","evidence":"/affected/0/versions"},{"value":"1.1.5","evidence":"/affected/0/versions"},{"value":"1.1.6","evidence":"/affected/0/versions"},{"value":"1.1.7","evidence":"/affected/0/versions"},{"value":"1.1.8","evidence":"/affected/0/versions"},{"value":"1.1.9","evidence":"/affected/0/versions"}]},{"name":{"value":"decepticon","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"1.1.0","evidence":"/affected/1/versions"},{"value":"1.1.1","evidence":"/affected/1/versions"},{"value":"1.1.10","evidence":"/affected/1/versions"},{"value":"1.1.11","evidence":"/affected/1/versions"},{"value":"1.1.12","evidence":"/affected/1/versions"},{"value":"1.1.13","evidence":"/affected/1/versions"},{"value":"1.1.14","evidence":"/affected/1/versions"},{"value":"1.1.15","evidence":"/affected/1/versions"},{"value":"1.1.16","evidence":"/affected/1/versions"},{"value":"1.1.2","evidence":"/affected/1/versions"},{"value":"1.1.3","evidence":"/affected/1/versions"},{"value":"1.1.4","evidence":"/affected/1/versions"},{"value":"1.1.5","evidence":"/affected/1/versions"},{"value":"1.1.6","evidence":"/affected/1/versions"},{"value":"1.1.7","evidence":"/affected/1/versions"},{"value":"1.1.8","evidence":"/affected/1/versions"},{"value":"1.1.9","evidence":"/affected/1/versions"}]},{"name":{"value":"decepticon-sdk","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.1.10","evidence":"/affected/2/versions"},{"value":"1.1.11","evidence":"/affected/2/versions"},{"value":"1.1.12","evidence":"/affected/2/versions"},{"value":"1.1.13","evidence":"/affected/2/versions"},{"value":"1.1.14","evidence":"/affected/2/versions"},{"value":"1.1.15","evidence":"/affected/2/versions"},{"value":"1.1.16","evidence":"/affected/2/versions"},{"value":"1.1.2","evidence":"/affected/2/versions"},{"value":"1.1.3","evidence":"/affected/2/versions"},{"value":"1.1.4","evidence":"/affected/2/versions"},{"value":"1.1.5","evidence":"/affected/2/versions"},{"value":"1.1.6","evidence":"/affected/2/versions"},{"value":"1.1.7","evidence":"/affected/2/versions"},{"value":"1.1.8","evidence":"/affected/2/versions"},{"value":"1.1.9","evidence":"/affected/2/versions"}]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-g5f9-3xfg-p9mf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61732","advisory_id":"9f8b0ee6-8111-4793-b8df-bb3e051dd1da","event_types":["advisory"],"published_at":"2026-10-25T19:28:26.416545+00:00","technologies":["core-cve","decepticon","decepticon-core","decepticon-sdk"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:40:51.248+00:00","detail_url":"/events/62554"},"members":[{"id":62554,"cve_ids":["CVE-2026-61732"],"payload":{"kind":"advisory","title":"Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context","summary":"Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.","evidence":"cve:CVE-2026-61732","products":[{"name":{"value":"Decepticon","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"decepticon-core","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"decepticon-sdk","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-61732","aliases":["CVE-2026-61732"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"BitterSecurity","product":"Decepticon","versions":[{"status":"affected","version":"< 1.1.17"}]},{"vendor":"BitterSecurity","product":"decepticon-core","versions":[{"status":"affected","version":"< 1.1.17"}]},{"vendor":"BitterSecurity","product":"decepticon-sdk","versions":[{"status":"affected","version":"< 1.1.17"}]}],"modified":"2026-09-24T18:00:43.383Z","provider":"cve","references":["https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","https://github.com/BitterSecurity/Decepticon/commit/79ee2aaf22f4c36a5b1968f6ca3f8086b6e35b67"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61732","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:59:08.643777Z"}}}],"references":[{"url":"https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T18:00:43.383Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T17:40:51.248Z"}}},"related_cves":[{"value":"CVE-2026-61732","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9f8b0ee6-8111-4793-b8df-bb3e051dd1da","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-61732","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"decepticon-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"1.1.10","evidence":"/affected/0/versions"},{"value":"1.1.11","evidence":"/affected/0/versions"},{"value":"1.1.12","evidence":"/affected/0/versions"},{"value":"1.1.13","evidence":"/affected/0/versions"},{"value":"1.1.14","evidence":"/affected/0/versions"},{"value":"1.1.15","evidence":"/affected/0/versions"},{"value":"1.1.16","evidence":"/affected/0/versions"},{"value":"1.1.2","evidence":"/affected/0/versions"},{"value":"1.1.3","evidence":"/affected/0/versions"},{"value":"1.1.4","evidence":"/affected/0/versions"},{"value":"1.1.5","evidence":"/affected/0/versions"},{"value":"1.1.6","evidence":"/affected/0/versions"},{"value":"1.1.7","evidence":"/affected/0/versions"},{"value":"1.1.8","evidence":"/affected/0/versions"},{"value":"1.1.9","evidence":"/affected/0/versions"}]},{"name":{"value":"decepticon","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"1.1.0","evidence":"/affected/1/versions"},{"value":"1.1.1","evidence":"/affected/1/versions"},{"value":"1.1.10","evidence":"/affected/1/versions"},{"value":"1.1.11","evidence":"/affected/1/versions"},{"value":"1.1.12","evidence":"/affected/1/versions"},{"value":"1.1.13","evidence":"/affected/1/versions"},{"value":"1.1.14","evidence":"/affected/1/versions"},{"value":"1.1.15","evidence":"/affected/1/versions"},{"value":"1.1.16","evidence":"/affected/1/versions"},{"value":"1.1.2","evidence":"/affected/1/versions"},{"value":"1.1.3","evidence":"/affected/1/versions"},{"value":"1.1.4","evidence":"/affected/1/versions"},{"value":"1.1.5","evidence":"/affected/1/versions"},{"value":"1.1.6","evidence":"/affected/1/versions"},{"value":"1.1.7","evidence":"/affected/1/versions"},{"value":"1.1.8","evidence":"/affected/1/versions"},{"value":"1.1.9","evidence":"/affected/1/versions"}]},{"name":{"value":"decepticon-sdk","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.1.17","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.1.10","evidence":"/affected/2/versions"},{"value":"1.1.11","evidence":"/affected/2/versions"},{"value":"1.1.12","evidence":"/affected/2/versions"},{"value":"1.1.13","evidence":"/affected/2/versions"},{"value":"1.1.14","evidence":"/affected/2/versions"},{"value":"1.1.15","evidence":"/affected/2/versions"},{"value":"1.1.16","evidence":"/affected/2/versions"},{"value":"1.1.2","evidence":"/affected/2/versions"},{"value":"1.1.3","evidence":"/affected/2/versions"},{"value":"1.1.4","evidence":"/affected/2/versions"},{"value":"1.1.5","evidence":"/affected/2/versions"},{"value":"1.1.6","evidence":"/affected/2/versions"},{"value":"1.1.7","evidence":"/affected/2/versions"},{"value":"1.1.8","evidence":"/affected/2/versions"},{"value":"1.1.9","evidence":"/affected/2/versions"}]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-g5f9-3xfg-p9mf","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61732","advisory_id":"9f8b0ee6-8111-4793-b8df-bb3e051dd1da","event_types":["advisory"],"published_at":"2026-10-25T19:28:26.416545+00:00","technologies":["core-cve","decepticon","decepticon-core","decepticon-sdk"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-24T17:40:51.248+00:00","detail_url":"/events/62554"}]}},{"id":63281,"cve_ids":["CVE-2026-102271"],"payload":{"kind":"advisory","title":"PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102271","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102271","aliases":["CVE-2026-102271"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.4.0, < 2.14.0"}]}],"modified":"2026-10-01T14:57:42.294Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773","https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102271","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T14:57:03.181101Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:57:42.294Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:31:53.066Z"}}},"related_cves":[{"value":"CVE-2026-102271","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b538ebb6-5cc6-49da-a52e-dd3eaf877a25","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102271","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/0/versions"},{"value":"2.10.1","evidence":"/affected/0/versions"},{"value":"2.11.0","evidence":"/affected/0/versions"},{"value":"2.12.0","evidence":"/affected/0/versions"},{"value":"2.12.1","evidence":"/affected/0/versions"},{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.4.0","evidence":"/affected/0/versions"},{"value":"2.5.0","evidence":"/affected/0/versions"},{"value":"2.6.0","evidence":"/affected/0/versions"},{"value":"2.7.0","evidence":"/affected/0/versions"},{"value":"2.8.0","evidence":"/affected/0/versions"},{"value":"2.9.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p4g4-x82p-q773","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102271","advisory_id":"b538ebb6-5cc6-49da-a52e-dd3eaf877a25","event_types":["advisory"],"published_at":"2026-10-25T19:28:21.086824+00:00","technologies":["core-cve","pyjwt"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T20:31:53.066+00:00","detail_url":"/advisories/advisory%3Ab538ebb6-5cc6-49da-a52e-dd3eaf877a25","group":{"id":"advisory:b538ebb6-5cc6-49da-a52e-dd3eaf877a25","revision":1,"primary_event_id":62544,"change":"published","superseded_by":[],"changed":{"id":62544,"cve_ids":["CVE-2026-102271"],"payload":{"kind":"advisory","title":"PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102271","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102271","aliases":["CVE-2026-102271"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.4.0, < 2.14.0"}]}],"modified":"2026-10-01T14:57:42.294Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773","https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102271","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T14:57:03.181101Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:57:42.294Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:31:53.066Z"}}},"related_cves":[{"value":"CVE-2026-102271","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b538ebb6-5cc6-49da-a52e-dd3eaf877a25","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102271","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/0/versions"},{"value":"2.10.1","evidence":"/affected/0/versions"},{"value":"2.11.0","evidence":"/affected/0/versions"},{"value":"2.12.0","evidence":"/affected/0/versions"},{"value":"2.12.1","evidence":"/affected/0/versions"},{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.4.0","evidence":"/affected/0/versions"},{"value":"2.5.0","evidence":"/affected/0/versions"},{"value":"2.6.0","evidence":"/affected/0/versions"},{"value":"2.7.0","evidence":"/affected/0/versions"},{"value":"2.8.0","evidence":"/affected/0/versions"},{"value":"2.9.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p4g4-x82p-q773","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102271","advisory_id":"b538ebb6-5cc6-49da-a52e-dd3eaf877a25","event_types":["advisory"],"published_at":"2026-10-25T19:28:21.086824+00:00","technologies":["core-cve","pyjwt"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-28T20:31:53.066+00:00","detail_url":"/events/62544"},"members":[{"id":62544,"cve_ids":["CVE-2026-102271"],"payload":{"kind":"advisory","title":"PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard","summary":"PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.","evidence":"cve:CVE-2026-102271","products":[{"name":{"value":"pyjwt","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102271","aliases":["CVE-2026-102271"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"status":"affected","version":">= 2.4.0, < 2.14.0"}]}],"modified":"2026-10-01T14:57:42.294Z","provider":"cve","references":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773","https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102271","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-01T14:57:03.181101Z"}}}],"references":[{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:57:42.294Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-28T20:31:53.066Z"}}},"related_cves":[{"value":"CVE-2026-102271","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b538ebb6-5cc6-49da-a52e-dd3eaf877a25","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102271","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"products":[{"name":{"value":"pyjwt","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.14.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/0/versions"},{"value":"2.10.1","evidence":"/affected/0/versions"},{"value":"2.11.0","evidence":"/affected/0/versions"},{"value":"2.12.0","evidence":"/affected/0/versions"},{"value":"2.12.1","evidence":"/affected/0/versions"},{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.4.0","evidence":"/affected/0/versions"},{"value":"2.5.0","evidence":"/affected/0/versions"},{"value":"2.6.0","evidence":"/affected/0/versions"},{"value":"2.7.0","evidence":"/affected/0/versions"},{"value":"2.8.0","evidence":"/affected/0/versions"},{"value":"2.9.0","evidence":"/affected/0/versions"}]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-p4g4-x82p-q773","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102271","advisory_id":"b538ebb6-5cc6-49da-a52e-dd3eaf877a25","event_types":["advisory"],"published_at":"2026-10-25T19:28:21.086824+00:00","technologies":["core-cve","pyjwt"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-28T20:31:53.066+00:00","detail_url":"/events/62544"}]}},{"id":62016,"cve_ids":["CVE-2026-92957"],"payload":{"kind":"advisory","title":"vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix","summary":"vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7.","evidence":"cve:CVE-2026-92957","products":[{"name":{"value":"vm2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-92957","aliases":["CVE-2026-92957"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.4,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"patriksimek","product":"vm2","versions":[{"status":"affected","version":"0","lessThan":"3.11.7","versionType":"semver"},{"status":"unaffected","version":"3.11.7","versionType":"semver"}],"packageURL":"pkg:npm/vm2","defaultStatus":"unaffected"}],"modified":"2026-09-26T13:30:01.519Z","provider":"cve","references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j","https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92957","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-17T17:24:58.866510Z"}}}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T17:25:19.354Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:30:01.519Z"}}},"related_cves":[{"value":"CVE-2026-92957","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:933f4619-3c2c-42c0-a1a7-87142edd08fc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-92957","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"vm2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-8686-vhfx-7r3j","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92957","advisory_id":"933f4619-3c2c-42c0-a1a7-87142edd08fc","event_types":["advisory"],"published_at":"2026-10-25T18:59:46.356392+00:00","technologies":["core-cve","vm2"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-17T13:46:14.875+00:00","detail_url":"/advisories/advisory%3A933f4619-3c2c-42c0-a1a7-87142edd08fc","group":{"id":"advisory:933f4619-3c2c-42c0-a1a7-87142edd08fc","revision":1,"primary_event_id":61258,"change":"published","superseded_by":[],"changed":{"id":61258,"cve_ids":["CVE-2026-92957"],"payload":{"kind":"advisory","title":"vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix","summary":"vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7.","evidence":"cve:CVE-2026-92957","products":[{"name":{"value":"vm2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-92957","aliases":["CVE-2026-92957"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.4,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"patriksimek","product":"vm2","versions":[{"status":"affected","version":"0","lessThan":"3.11.7","versionType":"semver"},{"status":"unaffected","version":"3.11.7","versionType":"semver"}],"packageURL":"pkg:npm/vm2","defaultStatus":"unaffected"}],"modified":"2026-09-26T13:30:01.519Z","provider":"cve","references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j","https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92957","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-17T17:24:58.866510Z"}}}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T17:25:19.354Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:30:01.519Z"}}},"related_cves":[{"value":"CVE-2026-92957","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:933f4619-3c2c-42c0-a1a7-87142edd08fc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-92957","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"vm2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-8686-vhfx-7r3j","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92957","advisory_id":"933f4619-3c2c-42c0-a1a7-87142edd08fc","event_types":["advisory"],"published_at":"2026-10-25T18:59:46.356392+00:00","technologies":["core-cve","vm2"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-17T13:46:14.875+00:00","detail_url":"/events/61258"},"members":[{"id":61258,"cve_ids":["CVE-2026-92957"],"payload":{"kind":"advisory","title":"vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix","summary":"vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution capability for untrusted sandbox code. Fixed in vm2 3.11.7.","evidence":"cve:CVE-2026-92957","products":[{"name":{"value":"vm2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-92957","aliases":["CVE-2026-92957"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.4,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"patriksimek","product":"vm2","versions":[{"status":"affected","version":"0","lessThan":"3.11.7","versionType":"semver"},{"status":"unaffected","version":"3.11.7","versionType":"semver"}],"packageURL":"pkg:npm/vm2","defaultStatus":"unaffected"}],"modified":"2026-09-26T13:30:01.519Z","provider":"cve","references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j","https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92957","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-17T17:24:58.866510Z"}}}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-17T17:25:19.354Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:30:01.519Z"}}},"related_cves":[{"value":"CVE-2026-92957","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:933f4619-3c2c-42c0-a1a7-87142edd08fc","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-92957","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"vm2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.7","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-8686-vhfx-7r3j","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92957","advisory_id":"933f4619-3c2c-42c0-a1a7-87142edd08fc","event_types":["advisory"],"published_at":"2026-10-25T18:59:46.356392+00:00","technologies":["core-cve","vm2"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-17T13:46:14.875+00:00","detail_url":"/events/61258"}]}},{"id":61781,"cve_ids":["CVE-2026-102992"],"payload":{"kind":"advisory","title":"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env","summary":"piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.","evidence":"cve:CVE-2026-102992","products":[{"name":{"value":"piscina","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102992","aliases":["CVE-2026-102992"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"piscinajs","product":"piscina","versions":[{"status":"affected","version":"< 4.9.4"},{"status":"affected","version":">= 5.0.0, < 5.3.2"},{"status":"affected","version":">= 6.0.0-rc.1, < 6.0.0-rc.5"}]}],"modified":"2026-09-30T20:47:49.562Z","provider":"cve","references":["https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f","https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72","https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7","https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6","https://github.com/piscinajs/piscina/releases/tag/v4.9.4","https://github.com/piscinajs/piscina/releases/tag/v5.3.2","https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102992","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T20:47:28.974211Z"}}}],"references":[{"url":"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:47:49.562Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:50:18.036Z"}}},"related_cves":[{"value":"CVE-2026-102992","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8bc112e2-0786-4b0b-86a3-35190be05135","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-102992","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"piscina","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.3.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"piscina","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.9.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"piscina","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.0.0-rc.5","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102992","advisory_id":"8bc112e2-0786-4b0b-86a3-35190be05135","event_types":["advisory"],"published_at":"2026-10-25T18:55:18.049263+00:00","technologies":["core-cve","piscina"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T19:50:18.036+00:00","detail_url":"/advisories/advisory%3A8bc112e2-0786-4b0b-86a3-35190be05135","group":{"id":"advisory:8bc112e2-0786-4b0b-86a3-35190be05135","revision":1,"primary_event_id":61027,"change":"published","superseded_by":[],"changed":{"id":61027,"cve_ids":["CVE-2026-102992"],"payload":{"kind":"advisory","title":"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env","summary":"piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.","evidence":"cve:CVE-2026-102992","products":[{"name":{"value":"piscina","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102992","aliases":["CVE-2026-102992"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"piscinajs","product":"piscina","versions":[{"status":"affected","version":"< 4.9.4"},{"status":"affected","version":">= 5.0.0, < 5.3.2"},{"status":"affected","version":">= 6.0.0-rc.1, < 6.0.0-rc.5"}]}],"modified":"2026-09-30T20:47:49.562Z","provider":"cve","references":["https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f","https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72","https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7","https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6","https://github.com/piscinajs/piscina/releases/tag/v4.9.4","https://github.com/piscinajs/piscina/releases/tag/v5.3.2","https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102992","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T20:47:28.974211Z"}}}],"references":[{"url":"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:47:49.562Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:50:18.036Z"}}},"related_cves":[{"value":"CVE-2026-102992","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8bc112e2-0786-4b0b-86a3-35190be05135","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-102992","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"piscina","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.3.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"piscina","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.9.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"piscina","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.0.0-rc.5","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102992","advisory_id":"8bc112e2-0786-4b0b-86a3-35190be05135","event_types":["advisory"],"published_at":"2026-10-25T18:55:18.049263+00:00","technologies":["core-cve","piscina"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T19:50:18.036+00:00","detail_url":"/events/61027"},"members":[{"id":61027,"cve_ids":["CVE-2026-102992"],"payload":{"kind":"advisory","title":"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env","summary":"piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.","evidence":"cve:CVE-2026-102992","products":[{"name":{"value":"piscina","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-102992","aliases":["CVE-2026-102992"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"piscinajs","product":"piscina","versions":[{"status":"affected","version":"< 4.9.4"},{"status":"affected","version":">= 5.0.0, < 5.3.2"},{"status":"affected","version":">= 6.0.0-rc.1, < 6.0.0-rc.5"}]}],"modified":"2026-09-30T20:47:49.562Z","provider":"cve","references":["https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f","https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72","https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7","https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6","https://github.com/piscinajs/piscina/releases/tag/v4.9.4","https://github.com/piscinajs/piscina/releases/tag/v5.3.2","https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102992","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-30T20:47:28.974211Z"}}}],"references":[{"url":"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:47:49.562Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:50:18.036Z"}}},"related_cves":[{"value":"CVE-2026-102992","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8bc112e2-0786-4b0b-86a3-35190be05135","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-102992","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"piscina","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"5.3.2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"piscina","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.9.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"piscina","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.0.0-rc.5","evidence":"/affected/2/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-67c8-pqhq-4rmx","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102992","advisory_id":"8bc112e2-0786-4b0b-86a3-35190be05135","event_types":["advisory"],"published_at":"2026-10-25T18:55:18.049263+00:00","technologies":["core-cve","piscina"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T19:50:18.036+00:00","detail_url":"/events/61027"}]}},{"id":61683,"cve_ids":["CVE-2026-102990"],"payload":{"kind":"advisory","title":"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)","summary":"basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.","evidence":"cve:CVE-2026-102990","products":[{"name":{"value":"basic-ftp","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102990","aliases":["CVE-2026-102990"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"patrickjuchli","product":"basic-ftp","versions":[{"status":"affected","version":"< 6.2.1"}]}],"modified":"2026-09-30T20:05:49.721Z","provider":"cve","references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102990","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T20:05:43.038485Z"}}}],"references":[{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:05:49.721Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:44:47.303Z"}}},"related_cves":[{"value":"CVE-2026-102990","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102990","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"basic-ftp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102990","advisory_id":"c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","event_types":["advisory"],"published_at":"2026-10-25T18:53:33.445916+00:00","technologies":["basic-ftp","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T19:44:47.303+00:00","detail_url":"/advisories/advisory%3Ac23a2c90-65ce-4138-b5e8-d51ea0a55ce8","group":{"id":"advisory:c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","revision":1,"primary_event_id":60931,"change":"published","superseded_by":[],"changed":{"id":60931,"cve_ids":["CVE-2026-102990"],"payload":{"kind":"advisory","title":"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)","summary":"basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.","evidence":"cve:CVE-2026-102990","products":[{"name":{"value":"basic-ftp","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102990","aliases":["CVE-2026-102990"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"patrickjuchli","product":"basic-ftp","versions":[{"status":"affected","version":"< 6.2.1"}]}],"modified":"2026-09-30T20:05:49.721Z","provider":"cve","references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102990","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T20:05:43.038485Z"}}}],"references":[{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:05:49.721Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:44:47.303Z"}}},"related_cves":[{"value":"CVE-2026-102990","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102990","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"basic-ftp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102990","advisory_id":"c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","event_types":["advisory"],"published_at":"2026-10-25T18:53:33.445916+00:00","technologies":["basic-ftp","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T19:44:47.303+00:00","detail_url":"/events/60931"},"members":[{"id":60931,"cve_ids":["CVE-2026-102990"],"payload":{"kind":"advisory","title":"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)","summary":"basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.","evidence":"cve:CVE-2026-102990","products":[{"name":{"value":"basic-ftp","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102990","aliases":["CVE-2026-102990"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"patrickjuchli","product":"basic-ftp","versions":[{"status":"affected","version":"< 6.2.1"}]}],"modified":"2026-09-30T20:05:49.721Z","provider":"cve","references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102990","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T20:05:43.038485Z"}}}],"references":[{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:05:49.721Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:44:47.303Z"}}},"related_cves":[{"value":"CVE-2026-102990","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102990","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"basic-ftp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102990","advisory_id":"c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","event_types":["advisory"],"published_at":"2026-10-25T18:53:33.445916+00:00","technologies":["basic-ftp","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T19:44:47.303+00:00","detail_url":"/events/60931"}]}}],"next_after":72190,"next_before":61683}