[{"id": "PYSEC-2025-19", "modified": "2027-07-09T15:54:00+00:00", "published": "2025-03-03T19:15:34+00:00", "aliases": ["CVE-2025-1889", "GHSA-769v-p64c-89pr"], "details": "picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic.", "affected": [{"package": {"ecosystem": "PyPI", "name": "picklescan", "purl": "pkg:pypi/picklescan"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0.0.22"}]}], "versions": ["0.0.1", "0.0.10", "0.0.11", "0.0.12", "0.0.13", "0.0.14", "0.0.15", "0.0.16", "0.0.17", "0.0.18", "0.0.19", "0.0.2", "0.0.20", "0.0.21", "0.0.3", "0.0.4", "0.0.5", "0.0.6", "0.0.7", "0.0.8", "0.0.9"]}], "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}], "references": [{"type": "EVIDENCE", "url": "https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1889"}, {"type": "ADVISORY", "url": "https://github.com/advisories/GHSA-769v-p64c-89pr"}], "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "pysec-2025-19"}]}}}, {"id": "PYSEC-2024-115", "details": "A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.", "aliases": ["CVE-2024-8309", "GHSA-45pg-36p6-83v9"], "modified": "2027-07-09T15:45:00Z", "published": "2024-11-05T16:04:14Z", "references": [{"type": "EVIDENCE", "url": "https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5"}, {"type": "WEB", "url": "https://huntr.com/bounties/8f4ad910-7fdc-4089-8f0a-b5df5f32e7c5"}, {"type": "FIX", "url": "https://github.com/langchain-ai/langchain/commit/c2a3021bb0c5f54649d380b42a0684ca5778c255"}, {"type": "ADVISORY", "url": "https://github.com/advisories/GHSA-45pg-36p6-83v9"}], "affected": [{"package": {"name": "langchain-community", "ecosystem": "PyPI", "purl": "pkg:pypi/langchain-community"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0.2.0"}, {"fixed": "0.3.0"}]}], "versions": ["0.2.0", "0.2.1", "0.2.2", "0.2.3", "0.2.4", "0.2.5", "0.2.6", "0.2.7", "0.2.9", "0.2.10", "0.2.11", "0.2.12", "0.2.13", "0.2.15", "0.2.16", "0.2.17", "0.2.18", "0.2.14", "0.3.0.dev1", "0.3.0.dev2", "0.2.19"]}], "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}], "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "pysec-2024-115"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12372", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2026-06-16T06:05:39.765Z", "datePublished": "2026-08-09T22:45:52.799Z", "dateUpdated": "2026-08-12T17:48:54.679Z"}, "containers": {"cna": {"title": "Server-Side Request Forgery (SSRF) in nltk/nltk", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-08-09T22:45:52.799Z"}, "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed."}], "affected": [{"vendor": "nltk", "product": "nltk/nltk", "versions": [{"version": "unspecified", "status": "affected", "versionType": "custom", "lessThanOrEqual": "latest"}]}], "references": [{"url": "https://huntr.com/bounties/2911b643-571c-42e4-b0c2-9a1fa6f491db"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.7, "baseSeverity": "LOW"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918"}]}], "source": {"advisory": "2911b643-571c-42e4-b0c2-9a1fa6f491db", "discovery": "EXTERNAL"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-12372"}]}, "adp": [{"references": [{"url": "https://huntr.com/bounties/2911b643-571c-42e4-b0c2-9a1fa6f491db", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:45:59.173613Z", "id": "CVE-2026-12372", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:48:54.679Z"}}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-69106", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2026-08-03T10:58:15.519Z", "datePublished": "2026-08-12T17:48:29.429Z", "dateUpdated": "2026-08-12T17:48:29.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2026-08-12T17:48:29.429Z"}, "title": "Potential cache poisoning in JFrog Artifactory", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "type": "CWE"}]}], "affected": [{"vendor": "jfrog", "product": "artifactory", "versions": [{"status": "affected", "version": "0", "lessThan": "7.146.29", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.</p>"}]}], "references": [{"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "tags": ["vendor-advisory"]}, {"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Uri Katz | Oligo Security", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-69106"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68752", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2026-07-31T13:38:38.864Z", "datePublished": "2026-08-12T14:55:01.413Z", "dateUpdated": "2026-08-12T17:44:53.723Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2026-08-12T17:44:53.723Z"}, "title": "Project Resource Managers may escalate privileges in JFrog Artifactory", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "type": "CWE"}]}], "affected": [{"vendor": "jfrog", "product": "artifactory", "versions": [{"status": "affected", "version": "0", "lessThan": "7.146.35", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A Project Resource Manager may gain broader administrative privileges under specific conditions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A Project Resource Manager may gain broader administrative privileges under specific conditions.</p>"}]}], "references": [{"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "tags": ["vendor-advisory"]}, {"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "OpenAI", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-68752"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34196", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "state": "PUBLISHED", "assignerShortName": "imaginationtech", "dateReserved": "2026-03-26T13:47:30.669Z", "datePublished": "2026-07-10T20:42:17.526Z", "dateUpdated": "2026-07-13T18:55:28.947Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2026-07-10T20:42:17.526Z"}, "title": "GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-416", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-124", "descriptions": [{"lang": "en", "value": "CAPEC-124: Shared Resource Manipulation"}]}], "affected": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "platforms": ["Linux", "Android"], "versions": [{"status": "affected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "lessThanOrEqual": "25.3 RTM", "versionType": "custom"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping\n\n\n\nThe second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping</p><p>The second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to.</p>"}]}], "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-34196"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:18:40.279772Z", "id": "CVE-2026-34196", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:55:28.947Z"}}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42018", "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "state": "PUBLISHED", "assignerShortName": "JFROG", "dateReserved": "2026-04-23T13:41:13.755Z", "datePublished": "2026-08-12T17:43:21.289Z", "dateUpdated": "2026-08-12T17:43:21.289Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d", "shortName": "JFROG", "dateUpdated": "2026-08-12T17:43:21.289Z"}, "title": "Anonymous user token generation exposure in JFrog Artifactory", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "type": "CWE"}]}], "affected": [{"vendor": "jfrog", "product": "artifactory", "versions": [{"status": "affected", "version": "0", "lessThan": "7.146.8", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.</p>"}]}], "references": [{"url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "tags": ["vendor-advisory"]}, {"url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Daniil Vylegzhanin (NetSPI)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-42018"}]}}}, {"schema_version": "1.4.0", "id": "GHSA-53w6-v7cv-fc9h", "modified": "2026-08-12T17:42:55Z", "published": "2026-06-10T00:31:52Z", "aliases": ["CVE-2026-41727"], "summary": "Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation", "details": "Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.\n\nAffected versions:\nSpring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}], "affected": [{"package": {"ecosystem": "Maven", "name": "org.springframework.kafka:spring-kafka"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.0.0"}, {"fixed": "4.0.6"}]}], "database_specific": {"last_known_affected_version_range": "<= 4.0.5"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.kafka:spring-kafka"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "3.3.0"}, {"fixed": "3.3.16"}]}], "database_specific": {"last_known_affected_version_range": "<= 3.3.15"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.kafka:spring-kafka"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "3.2.0"}, {"last_affected": "3.2.13"}]}]}, {"package": {"ecosystem": "Maven", "name": "org.springframework.kafka:spring-kafka"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "2.9.0"}, {"last_affected": "2.9.13"}]}]}, {"package": {"ecosystem": "Maven", "name": "org.springframework.kafka:spring-kafka"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"last_affected": "2.8.11"}]}]}], "references": [{"type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41727"}, {"type": "PACKAGE", "url": "https://github.com/spring-projects/spring-kafka"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-kafka/releases/tag/v3.3.16"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-kafka/releases/tag/v4.0.6"}, {"type": "WEB", "url": "https://spring.io/security/cve-2026-41727"}], "database_specific": {"cwe_ids": ["CWE-20"], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2026-08-12T17:42:55Z", "nvd_published_at": "2026-06-10T00:16:52Z"}, "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "ghsa-53w6-v7cv-fc9h"}]}}}, {"schema_version": "1.4.0", "id": "GHSA-p5mm-xwgq-whfr", "modified": "2026-08-12T17:42:43Z", "published": "2026-06-10T00:31:52Z", "aliases": ["CVE-2026-41730"], "summary": "Spring Data REST potentially exposes persistence-layer internals to HTTP clients", "details": "Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.\n\nAffected versions:\nSpring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}], "affected": [{"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "5.0.0"}, {"fixed": "5.0.6"}]}], "database_specific": {"last_known_affected_version_range": "<= 5.0.5"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.5.0"}, {"fixed": "4.5.12"}]}], "database_specific": {"last_known_affected_version_range": "<= 4.5.11"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.4.0"}, {"last_affected": "4.4.14"}]}]}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.3.0"}, {"last_affected": "4.3.16"}]}]}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"last_affected": "3.7.19"}]}]}], "references": [{"type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41730"}, {"type": "PACKAGE", "url": "https://github.com/spring-projects/spring-data-rest"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6"}, {"type": "WEB", "url": "https://spring.io/security/cve-2026-41730"}], "database_specific": {"cwe_ids": ["CWE-209"], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2026-08-12T17:42:43Z", "nvd_published_at": "2026-06-10T00:16:52Z"}, "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "ghsa-p5mm-xwgq-whfr"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41154", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "state": "PUBLISHED", "assignerShortName": "imaginationtech", "dateReserved": "2026-04-17T16:26:03.730Z", "datePublished": "2026-07-10T20:46:06.747Z", "dateUpdated": "2026-07-13T18:55:25.696Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2026-07-10T20:46:06.747Z"}, "title": "GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-123", "descriptions": [{"lang": "en", "value": "CAPEC-123: Buffer Manipulation"}]}], "affected": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "platforms": ["Linux", "Android"], "versions": [{"status": "unaffected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "unaffected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "lessThanOrEqual": "25.3 RTM", "versionType": "custom"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.\n\n\n\nWhen indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls.</p><p>When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.</p>"}]}], "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-41154"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:19:41.693234Z", "id": "CVE-2026-41154", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:55:25.696Z"}}]}}, {"schema_version": "1.4.0", "id": "GHSA-j388-8rm5-p97f", "modified": "2026-08-12T17:41:54Z", "published": "2026-06-10T00:31:52Z", "aliases": ["CVE-2026-41729"], "summary": "Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests", "details": "Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation.\n\nAffected versions:\nSpring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}], "affected": [{"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "5.0.0"}, {"fixed": "5.0.6"}]}], "database_specific": {"last_known_affected_version_range": "<= 5.0.5"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.5.0"}, {"fixed": "4.5.12"}]}], "database_specific": {"last_known_affected_version_range": "<= 4.5.11"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.4.0"}, {"last_affected": "4.4.14"}]}]}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.3.0"}, {"last_affected": "4.3.16"}]}]}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"last_affected": "3.7.19"}]}]}], "references": [{"type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41729"}, {"type": "PACKAGE", "url": "https://github.com/spring-projects/spring-data-rest"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6"}, {"type": "WEB", "url": "https://spring.io/security/cve-2026-41729"}], "database_specific": {"cwe_ids": ["CWE-917"], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-08-12T17:41:53Z", "nvd_published_at": "2026-06-10T00:16:52Z"}, "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "ghsa-j388-8rm5-p97f"}]}}}, {"schema_version": "1.4.0", "id": "GHSA-cv39-x4c6-hhp2", "modified": "2026-08-12T17:41:04Z", "published": "2026-06-10T00:31:52Z", "aliases": ["CVE-2026-41728"], "summary": "Spring Data REST has Improper Access Control in its JSON Patch Implementation", "details": "Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.\n\nAffected versions:\nSpring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}], "affected": [{"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "5.0.0"}, {"fixed": "5.0.6"}]}], "database_specific": {"last_known_affected_version_range": "<= 5.0.5"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.5.0"}, {"fixed": "4.5.12"}]}], "database_specific": {"last_known_affected_version_range": "<= 4.5.11"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.4.0"}, {"last_affected": "4.4.14"}]}]}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "4.3.0"}, {"last_affected": "4.3.16"}]}]}, {"package": {"ecosystem": "Maven", "name": "org.springframework.data:spring-data-rest-core"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"last_affected": "3.7.19"}]}]}], "references": [{"type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41728"}, {"type": "PACKAGE", "url": "https://github.com/spring-projects/spring-data-rest"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6"}, {"type": "WEB", "url": "https://spring.io/security/cve-2026-41728"}], "database_specific": {"cwe_ids": ["CWE-284"], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-08-12T17:41:04Z", "nvd_published_at": "2026-06-10T00:16:52Z"}, "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "ghsa-cv39-x4c6-hhp2"}]}}}, {"schema_version": "1.4.0", "id": "GHSA-gg69-9wwp-6jx2", "modified": "2026-08-12T17:40:21Z", "published": "2026-06-10T00:31:52Z", "aliases": ["CVE-2026-41732"], "summary": "Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization", "details": "JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list.\n\nAffected versions:\nSpring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}], "affected": [{"package": {"ecosystem": "Maven", "name": "org.springframework.pulsar:spring-pulsar"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "2.0.0"}, {"fixed": "2.0.6"}]}], "database_specific": {"last_known_affected_version_range": "<= 2.0.5"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.pulsar:spring-pulsar"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "1.2.0"}, {"fixed": "1.2.18"}]}], "database_specific": {"last_known_affected_version_range": "<= 1.2.17"}}, {"package": {"ecosystem": "Maven", "name": "org.springframework.pulsar:spring-pulsar"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"last_affected": "1.1.17"}]}]}], "references": [{"type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41732"}, {"type": "PACKAGE", "url": "https://github.com/spring-projects/spring-pulsar"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-pulsar/releases/tag/v1.2.18"}, {"type": "WEB", "url": "https://github.com/spring-projects/spring-pulsar/releases/tag/v2.0.6"}, {"type": "WEB", "url": "https://spring.io/security/cve-2026-41732"}], "database_specific": {"cwe_ids": ["CWE-502"], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-08-12T17:40:21Z", "nvd_published_at": "2026-06-10T00:16:52Z"}, "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "ghsa-gg69-9wwp-6jx2"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45196", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "state": "PUBLISHED", "assignerShortName": "imaginationtech", "dateReserved": "2026-05-11T10:58:04.162Z", "datePublished": "2026-07-10T20:53:50.761Z", "dateUpdated": "2026-07-15T03:59:55.338Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2026-07-10T20:53:50.761Z"}, "title": "GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-280", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges (4.15)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-480", "descriptions": [{"lang": "en", "value": "CAPEC-480: Escaping Virtualization (Version 3.9)"}]}], "affected": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "platforms": ["Linux", "Android"], "versions": [{"status": "affected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "lessThanOrEqual": "25.3 RTM", "versionType": "custom"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.</p>"}]}], "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-45196"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-45196"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T03:59:55.338Z"}}]}}, {"schema_version": "1.7.4", "id": "MAL-2026-13915", "published": "2026-08-12T15:13:19Z", "modified": "2026-08-12T17:40:05.796799912Z", "aliases": ["GHSA-hg96-r46x-6f4w"], "summary": "Malicious code in kit-map-vim (npm)", "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc)\nOn import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check. The.dat file is a Linux x86_64 ELF RedShell remote-access implant disguised as a 'native math accelerator'. The implant beacons to hardcoded C2 host 217.60.77.63 over plain HTTP and exposes command handlers that download and execute additional ELF binaries and shellcode from http://217.60.77.63/Others/* and /SC/* endpoints, including in-memory execution via memfd_create/fexecve to avoid touching disk. It installs a masquerading systemd user unit 'svc-update.service' (Description=System Update Service, Restart=always) for persistence, provides SOCKS5 proxy and TCP port-forwarding, and offers built-in commands to enumerate users/env/processes/network configuration, harvest SSH keys and credentials from ~/.ssh and credential stores, and stream arbitrary filesystem paths to the operator via a chunked 'POST /api/extract-receive' handler labeled with a 'Loot_*' destination. The package's stated day-math purpose has no need for a native binary; the ELF's exposed command set (RedShell) is unrelated to any math functionality.\n\n## Source: ghsa-malware (4eb4b412fdc46f4d5569e4b581cf64a9e1bed94cc7cd8fcd91613b98f73ac20f)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n", "affected": [{"package": {"name": "kit-map-vim", "ecosystem": "npm"}, "ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}]}], "versions": ["1.0.0"], "database_specific": {"cwes": [{"cweId": "CWE-506", "description": "The product contains code that appears to be malicious in nature.", "name": "Embedded Malicious Code"}, {"cweId": "CWE-506", "description": "The product contains code that appears to be malicious in nature.", "name": "Embedded Malicious Code"}], "indicators": {"evidence_files": [{"path": "dist/index.mjs", "sha256": "9e8a5128cea298d21b8e3b24102d48cd3b256bb7f229e75c854ccfbe8ed4fb76", "tlsh": "76413466afbd632997fc07828e38b193292d84430f92dd95d94e473861c0b58e3c0979"}, {"path": "dist/internal/calc-math.dat", "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466", "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"}], "package_integrity": [{"filename": "kit-map-vim-1.0.0.tgz", "hashes": {"sha1": "1b70259d469fe44fd1e86a9c73c682f19b989c4c", "sha512_sri": "sha512-pMUdSKe6broCXlqYTgEnI8QwmxW+VkXXq0B9sQXtZ3lSd+jQE6xVa3uR1BIj6WiRU+XE6GrCMgNk3x1gX0hSSA=="}}]}}}], "references": [{"type": "PACKAGE", "url": "https://www.npmjs.com/package/kit-map-vim/v/1.0.0"}, {"type": "ADVISORY", "url": "https://github.com/advisories/GHSA-hg96-r46x-6f4w"}], "database_specific": {"malicious-packages-origins": [{"id": "IN-MAL-2026-017608", "import_time": "2026-08-12T15:26:14.391620943Z", "modified_time": "2026-08-12T15:13:19Z", "sha256": "03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc", "source": "amazon-inspector", "versions": ["1.0.0"]}, {"id": "GHSA-hg96-r46x-6f4w", "import_time": "2026-08-12T17:38:23.126271095Z", "modified_time": "2026-08-12T17:35:49Z", "ranges": [{"events": [{"introduced": "0"}], "type": "SEMVER"}], "sha256": "4eb4b412fdc46f4d5569e4b581cf64a9e1bed94cc7cd8fcd91613b98f73ac20f", "source": "ghsa-malware"}]}, "credits": [{"name": "Amazon Inspector", "contact": ["inspector-research@amazon.com"], "type": "FINDER"}], "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "mal-2026-13915"}]}}}, {"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-26804", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.179Z", "datePublished": "2024-04-04T08:20:31.305Z", "dateUpdated": "2026-08-12T17:39:59.942Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:24.842Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_tunnel: prevent perpetual headroom growth\n\nsyzkaller triggered following kasan splat:\nBUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\nRead of size 1 at addr ffff88812fb4000e by task syz-executor183/5191\n[..]\n kasan_report+0xda/0x110 mm/kasan/report.c:588\n __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170\n skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline]\n ___skb_get_hash net/core/flow_dissector.c:1791 [inline]\n __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856\n skb_get_hash include/linux/skbuff.h:1556 [inline]\n ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748\n ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592\n ...\n ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235\n ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323\n ..\n iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82\n ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831\n ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564\n ...\n\nThe splat occurs because skb->data points past skb->head allocated area.\nThis is because neigh layer does:\n  __skb_pull(skb, skb_network_offset(skb));\n\n... but skb_network_offset() returns a negative offset and __skb_pull()\narg is unsigned.  IOW, we skb->data gets \"adjusted\" by a huge value.\n\nThe negative value is returned because skb->head and skb->data distance is\nmore than 64k and skb->network_header (u16) has wrapped around.\n\nThe bug is in the ip_tunnel infrastructure, which can cause\ndev->needed_headroom to increment ad infinitum.\n\nThe syzkaller reproducer consists of packets getting routed via a gre\ntunnel, and route of gre encapsulated packets pointing at another (ipip)\ntunnel.  The ipip encapsulation finds gre0 as next output device.\n\nThis results in the following pattern:\n\n1). First packet is to be sent out via gre0.\nRoute lookup found an output device, ipip0.\n\n2).\nip_tunnel_xmit for gre0 bumps gre0->needed_headroom based on the future\noutput device, rt.dev->needed_headroom (ipip0).\n\n3).\nip output / start_xmit moves skb on to ipip0. which runs the same\ncode path again (xmit recursion).\n\n4).\nRouting step for the post-gre0-encap packet finds gre0 as output device\nto use for ipip0 encapsulated packet.\n\ntunl0->needed_headroom is then incremented based on the (already bumped)\ngre0 device headroom.\n\nThis repeats for every future packet:\n\ngre0->needed_headroom gets inflated because previous packets' ipip0 step\nincremented rt->dev (gre0) headroom, and ipip0 incremented because gre0\nneeded_headroom was increased.\n\nFor each subsequent packet, gre/ipip0->needed_headroom grows until\npost-expand-head reallocations result in a skb->head/data distance of\nmore than 64k.\n\nOnce that happens, skb->network_header (u16) wraps around when\npskb_expand_head tries to make sure that skb_network_offset() is unchanged\nafter the headroom expansion/reallocation.\n\nAfter this skb_network_offset(skb) returns a different (and negative)\nresult post headroom expansion.\n\nThe next trip to neigh layer (or anything else that would __skb_pull the\nnetwork header) makes skb->data point to a memory location outside\nskb->head area.\n\nv2: Cap the needed_headroom update to an arbitarily chosen upperlimit to\nprevent perpetual increase instead of dropping the headroom increment\ncompletely."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker must locally configure a two-device ip_tunnel routing cycle (gre0 \u2194 tunl0) via rtnetlink/ioctl and then transmit packets through a local socket; a remote peer cannot create the tunnel topology that drives the headroom growth.\nAC:L - The headroom inflation is fully deterministic \u2014 each transmitted packet monotonically increases dev->needed_headroom until the u16 network_header wraps, with no race and no dependence on memory layout the attacker cannot influence. The required ipip/gre modules are standard on virtually all distributions.\nPR:L - An unprivileged user gains CAP_NET_ADMIN over a private netns via unshare -Urn, since rtnetlink checks netlink_net_capable() against the netns owning user_ns, and tunl0/gre0 fallback devices are auto-created in every netns because sysctl_fb_tunnels_only_for_init_net defaults to 0.\nUI:N - The attacker performs the entire setup and packet transmission alone; no victim action or interaction is required.\nS:U - The corruption occurs in kernel memory within the same security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - After the offset overflow skb->data points ~4GB away in the kernel direct map, producing the syzbot-confirmed KASAN out-of-bounds/use-after-free read in __skb_flow_dissect, and the resulting packet's payload is read from that arbitrary kernel memory and transmitted to the attacker-chosen tunnel destination \u2014 up to ~64KB of kernel memory disclosure.\nI:H - skb_push() only validates data < head, so iptunnel_xmit() writes a 20-byte IP header (with attacker-controlled saddr/daddr/tos/ttl) plus the GRE header and attacker-chosen GRE key into out-of-bounds kernel memory, giving a partially controlled write primitive suitable for corrupting adjacent kernel objects.\nA:H - The confirmed use-after-free/out-of-bounds access reliably causes a KASAN report, oops, or panic (unmapped-address dereference or skb_under_panic), and the unbounded needed_headroom growth also forces ever-larger skb reallocations."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/ip_tunnel.c"], "versions": [{"version": "243aad830e8a4cdda261626fbaeddde16b08d04a", "lessThan": "f81e94d2dcd2397137edcb8b85f4c5bed5d22383", "status": "affected", "versionType": "git"}, {"version": "243aad830e8a4cdda261626fbaeddde16b08d04a", "lessThan": "2e95350fe9db9d53c701075060ac8ac883b68aee", "status": "affected", "versionType": "git"}, {"version": "243aad830e8a4cdda261626fbaeddde16b08d04a", "lessThan": "afec0c5cd2ed71ca95a8b36a5e6d03333bf34282", "status": "affected", "versionType": "git"}, {"version": "243aad830e8a4cdda261626fbaeddde16b08d04a", "lessThan": "ab63de24ebea36fe73ac7121738595d704b66d96", "status": "affected", "versionType": "git"}, {"version": "243aad830e8a4cdda261626fbaeddde16b08d04a", "lessThan": "a0a1db40b23e8ff86dea2786c5ea1470bb23ecb9", "status": "affected", "versionType": "git"}, {"version": "243aad830e8a4cdda261626fbaeddde16b08d04a", "lessThan": "049d7989c67e8dd50f07a2096dbafdb41331fb9b", "status": "affected", "versionType": "git"}, {"version": "243aad830e8a4cdda261626fbaeddde16b08d04a", "lessThan": "5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f", "status": "affected", "versionType": "git"}, {"version": "03017375b0122453e6dda833ff7bd4191915def5", "status": "affected", "versionType": "git"}, {"version": "2.6.33.2", "lessThan": "2.6.34", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/ip_tunnel.c"], "versions": [{"version": "2.6.34", "status": "affected"}, {"version": "0", "lessThan": "2.6.34", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.271", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.212", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.151", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.81", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "5.4.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "5.10.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "5.15.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.1.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.7.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.34", "versionEndExcluding": "6.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f81e94d2dcd2397137edcb8b85f4c5bed5d22383"}, {"url": "https://git.kernel.org/stable/c/2e95350fe9db9d53c701075060ac8ac883b68aee"}, {"url": "https://git.kernel.org/stable/c/afec0c5cd2ed71ca95a8b36a5e6d03333bf34282"}, {"url": "https://git.kernel.org/stable/c/ab63de24ebea36fe73ac7121738595d704b66d96"}, {"url": "https://git.kernel.org/stable/c/a0a1db40b23e8ff86dea2786c5ea1470bb23ecb9"}, {"url": "https://git.kernel.org/stable/c/049d7989c67e8dd50f07a2096dbafdb41331fb9b"}, {"url": "https://git.kernel.org/stable/c/5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f"}], "title": "net: ip_tunnel: prevent perpetual headroom growth", "x_generator": {"engine": "bippy-1.2.0"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2024-26804"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:39:19.030766Z", "id": "CVE-2024-26804", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:39:59.942Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.557Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/f81e94d2dcd2397137edcb8b85f4c5bed5d22383", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2e95350fe9db9d53c701075060ac8ac883b68aee", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/afec0c5cd2ed71ca95a8b36a5e6d03333bf34282", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ab63de24ebea36fe73ac7121738595d704b66d96", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a0a1db40b23e8ff86dea2786c5ea1470bb23ecb9", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/049d7989c67e8dd50f07a2096dbafdb41331fb9b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.2"}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15534", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-12T17:04:25.249Z", "datePublished": "2026-08-09T17:49:50.033Z", "dateUpdated": "2026-08-12T17:38:26.694Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "perl", "product": "perl", "programFiles": ["regexec.c"], "programRoutines": [{"name": "S_regmatch"}], "repo": "https://github.com/Perl/perl5", "vendor": "LEONT", "versions": [{"lessThanOrEqual": "5.45.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-09T17:49:50.033Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch"}, {"tags": ["patch"], "url": "https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to a future Perl release, or apply the upstream patches."}], "source": {"discovery": "UNKNOWN"}, "title": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch", "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-15534"}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/09/12"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/09/13"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-09T22:07:56.263Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:38:23.129391Z", "id": "CVE-2026-15534", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:38:26.694Z"}}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-31245", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-03-29T16:01:52.602Z", "datePublished": "2024-04-10T15:52:20.321Z", "dateUpdated": "2026-08-12T17:38:21.686Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "convertkit", "product": "ConvertKit", "vendor": "ConvertKit", "versions": [{"changes": [{"at": "2.4.6", "status": "unaffected"}], "lessThanOrEqual": "2.4.5", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Joshua Chan (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insertion of Sensitive Information into Log File vulnerability in ConvertKit.<p>This issue affects ConvertKit: from n/a through 2.4.5.</p>"}], "value": "Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:09:28.968Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/convertkit/wordpress-convertkit-plugin-2-4-5-email-disclosure-in-log-file-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 2.4.6 or a higher version."}], "value": "Update to 2.4.6 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2024-31245"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:38:18.437991Z", "id": "CVE-2024-31245", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:38:21.686Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:46:04.958Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/convertkit/wordpress-convertkit-plugin-2-4-5-email-disclosure-in-log-file-vulnerability?_s_id=cve"}]}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-31249", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-03-29T16:02:04.722Z", "datePublished": "2024-04-10T15:48:21.043Z", "dateUpdated": "2026-08-12T17:36:54.470Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "subscribe-to-comments-reloaded", "product": "Subscribe To Comments Reloaded", "vendor": "WPKube", "versions": [{"changes": [{"at": "240119", "status": "unaffected"}], "lessThanOrEqual": "220725", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Joshua Chan (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.<p>This issue affects Subscribe To Comments Reloaded: from n/a through 220725.</p>"}], "value": "Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:09:29.030Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-220725-sensitive-data-exposure-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 240119 or a higher version."}], "value": "Update to 240119 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Subscribe To Comments Reloaded plugin <= 220725 - Sensitive Data Exposure vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2024-31249"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:36:51.657698Z", "id": "CVE-2024-31249", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:36:54.470Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:46:04.990Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/subscribe-to-comments-reloaded/wordpress-subscribe-to-comments-reloaded-plugin-220725-sensitive-data-exposure-vulnerability?_s_id=cve"}]}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16907", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-24T06:19:28.890Z", "datePublished": "2026-08-12T17:36:49.120Z", "dateUpdated": "2026-08-12T17:36:49.120Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-12T17:36:49.120Z"}, "title": "IBM i is Affected By Multiple Vulnerabilities in the Debug Server", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "i", "versions": [{"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.3"}], "cpes": ["cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283276", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nIBM i Release5770-SS1\nPTF Number(s)PTF Download Link(s)7.6SJ10899 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899 7.5SJ10903 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903 7.4SJ10915 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915 7.3SJ10916 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916 \n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><colgroup><col/><col/><col/></colgroup><thead><tr><td><strong>IBM i Release</strong></td><td><strong>5770-SS1<br/>PTF Number(s)</strong></td><td><strong>PTF Download Link(s)</strong></td></tr></thead><tbody><tr><td>7.6</td><td>SJ10899</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899</a></td></tr><tr><td>7.5</td><td>SJ10903</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903</a></td></tr><tr><td>7.4</td><td>SJ10915</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915</a></td></tr><tr><td>7.3</td><td>SJ10916</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916</a></td></tr></tbody></table></div><p>IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.</p>"}]}], "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-16907"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17510", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-27T00:17:17.758Z", "datePublished": "2026-08-09T01:21:30.439Z", "dateUpdated": "2026-08-12T17:35:54.067Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-OpenSSL-PKCS12", "product": "Crypt::OpenSSL::PKCS12", "programFiles": ["PKCS12.xs"], "programRoutines": [{"name": "Crypt::OpenSSL::PKCS12::info_as_hash"}], "repo": "https://github.com/dsully/perl-crypt-openssl-pkcs12", "vendor": "JONASBN", "versions": [{"lessThan": "1.98", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.\n\nprint_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.\n\nAny caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-09T01:21:30.439Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.98/source/Changes.md"}, {"tags": ["patch"], "url": "https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to Crypt::OpenSSL::PKCS12 1.98 or later, which sizes the buffer on the decoded string length plus one and writes an explicit terminator."}], "source": {"discovery": "UNKNOWN"}, "title": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 1.98, ensure that PKCS#12 files passed to info_as_hash() come from trusted sources."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-17510"}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/09/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-09T03:32:58.521Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:35:51.161155Z", "id": "CVE-2026-17510", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:35:54.067Z"}}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17248", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-24T22:00:33.143Z", "datePublished": "2026-08-12T17:35:51.918Z", "dateUpdated": "2026-08-12T17:35:51.918Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-12T17:35:51.918Z"}, "title": "IBM i is Affected By Multiple Vulnerabilities in the Debug Server", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "i", "versions": [{"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.3"}], "cpes": ["cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283276", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nIBM i Release5770-SS1\nPTF Number(s)PTF Download Link(s)7.6SJ10899 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899 7.5SJ10903 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903 7.4SJ10915 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915 7.3SJ10916 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916 \n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><colgroup><col/><col/><col/></colgroup><thead><tr><td><strong>IBM i Release</strong></td><td><strong>5770-SS1<br/>PTF Number(s)</strong></td><td><strong>PTF Download Link(s)</strong></td></tr></thead><tbody><tr><td>7.6</td><td>SJ10899</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899</a></td></tr><tr><td>7.5</td><td>SJ10903</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903</a></td></tr><tr><td>7.4</td><td>SJ10915</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915</a></td></tr><tr><td>7.3</td><td>SJ10916</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916</a></td></tr></tbody></table></div><p>IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.</p>"}]}], "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-17248"}]}}}, {"modified": "2026-08-12T17:35:49Z", "published": "2026-08-12T17:35:48Z", "schema_version": "1.7.4", "id": "MAL-2026-13927", "aliases": ["GHSA-mpgw-38v3-8q5v"], "summary": "Malicious code in svelte-kit-vim (npm)", "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (2a5c81b69d1fdbadd71df58efb55efcff6225ee5796501b16c8908f23c3b8ce0)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n", "affected": [{"package": {"ecosystem": "npm", "name": "svelte-kit-vim"}, "ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}]}], "database_specific": {"cwes": [{"cweId": "CWE-506", "description": "The product contains code that appears to be malicious in nature.", "name": "Embedded Malicious Code"}]}}], "references": [{"type": "ADVISORY", "url": "https://github.com/advisories/GHSA-mpgw-38v3-8q5v"}], "database_specific": {"malicious-packages-origins": [{"id": "GHSA-mpgw-38v3-8q5v", "import_time": "2026-08-12T17:38:23.132712925Z", "modified_time": "2026-08-12T17:35:49Z", "ranges": [{"events": [{"introduced": "0"}], "type": "SEMVER"}], "sha256": "2a5c81b69d1fdbadd71df58efb55efcff6225ee5796501b16c8908f23c3b8ce0", "source": "ghsa-malware"}]}, "containers": {"cna": {"x_gcve": [{"recordType": "advisory", "vulnId": "mal-2026-13927"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61133", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-07-08T15:51:55.615Z", "datePublished": "2026-07-21T21:38:21.038Z", "dateUpdated": "2026-08-12T17:35:40.679Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-07-21T21:38:21.038Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Commerce Platform", "versions": [{"version": "11.4.0", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:commerce_platform:11.4.0:*:*:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-61133"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:35:35.452956Z", "id": "CVE-2026-61133", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:35:40.679Z"}}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17271", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-24T23:23:43.642Z", "datePublished": "2026-08-12T17:35:22.967Z", "dateUpdated": "2026-08-12T17:35:22.967Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-12T17:35:22.967Z"}, "title": "IBM i is Affected By Multiple Vulnerabilities in the Debug Server", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "i", "versions": [{"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.3"}], "cpes": ["cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283276", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nIBM i Release5770-SS1\nPTF Number(s)PTF Download Link(s)7.6SJ10899 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899 7.5SJ10903 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903 7.4SJ10915 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915 7.3SJ10916 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916 \n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><colgroup><col/><col/><col/></colgroup><thead><tr><td><strong>IBM i Release</strong></td><td><strong>5770-SS1<br/>PTF Number(s)</strong></td><td><strong>PTF Download Link(s)</strong></td></tr></thead><tbody><tr><td>7.6</td><td>SJ10899</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10899</a></td></tr><tr><td>7.5</td><td>SJ10903</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10903</a></td></tr><tr><td>7.4</td><td>SJ10915</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10915</a></td></tr><tr><td>7.3</td><td>SJ10916</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10916</a></td></tr></tbody></table></div><p>IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.</p>"}]}], "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-17271"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17218", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-24T20:07:39.903Z", "datePublished": "2026-08-12T17:35:04.408Z", "dateUpdated": "2026-08-12T17:35:04.408Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-08-12T17:35:04.408Z"}, "title": "IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "i", "versions": [{"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.3"}], "cpes": ["cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7283277", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nIBM i Release5770-SS1\nPTF Number(s)PTF Download Link(s)7.6SJ10872 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10872 7.5SJ10896 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10896 7.4SJ10929 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10929 7.3SJ10930 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10930 \n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><colgroup><col/><col/><col/></colgroup><thead><tr><td><strong>IBM i Release</strong></td><td><strong>5770-SS1<br/>PTF Number(s)</strong></td><td><strong>PTF Download Link(s)</strong></td></tr></thead><tbody><tr><td>7.6</td><td>SJ10872</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10872\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10872</a></td></tr><tr><td>7.5</td><td>SJ10896</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10896\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10896</a></td></tr><tr><td>7.4</td><td>SJ10929</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10929\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10929</a></td></tr><tr><td>7.3</td><td>SJ10930</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10930\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10930</a></td></tr></tbody></table></div><p>IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.</p>"}]}], "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-17218"}]}}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45203", "assignerOrgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "state": "PUBLISHED", "assignerShortName": "imaginationtech", "dateReserved": "2026-05-11T10:58:04.163Z", "datePublished": "2026-07-10T20:57:19.733Z", "dateUpdated": "2026-07-13T18:55:12.679Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "367425dc-4d06-4041-9650-c2dc6aaa27ce", "shortName": "imaginationtech", "dateUpdated": "2026-07-10T20:57:19.733Z"}, "title": "GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE - CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition (4.20)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-480", "descriptions": [{"lang": "en", "value": "CAPEC - CAPEC-480: Escaping Virtualization (Version 3.9)"}]}], "affected": [{"vendor": "Imagination Technologies", "product": "Graphics DDK", "platforms": ["Linux", "Android"], "versions": [{"status": "affected", "version": "1.18 RTM2", "versionType": "custom"}, {"status": "affected", "version": "23.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "24.2 RTM2", "versionType": "custom"}, {"status": "affected", "version": "25.1 RTM2", "lessThanOrEqual": "25.3 RTM", "versionType": "custom"}, {"status": "affected", "version": "26.1 RTM1", "versionType": "custom"}, {"status": "unaffected", "version": "26.1 RTM2", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel.\n\n\n\nA TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel.\n<br>\n<br>A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.</p>"}]}], "references": [{"url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-45203"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:33:59.825342Z", "id": "CVE-2026-45203", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:55:12.679Z"}}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12382", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-16T10:07:17.206Z", "datePublished": "2026-07-15T17:21:28.516Z", "dateUpdated": "2026-08-12T17:34:15.091Z"}, "containers": {"cna": {"title": "Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "automation-gateway", "defaultStatus": "affected", "versions": [{"version": "0:2.5.20260715-1.el8ap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.5::el8", "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "automation-gateway", "defaultStatus": "affected", "versions": [{"version": "0:2.5.20260715-1.el9ap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.5::el8", "cpe:/a:redhat:ansible_automation_platform:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8", "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "automation-gateway", "defaultStatus": "affected", "versions": [{"version": "0:2.6.20260422-1.el9ap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el10", "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "ansible-automation-platform-26/gateway-rhel9", "defaultStatus": "affected", "versions": [{"version": "1777311120", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.7", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "ansible-automation-platform-27/gateway-rhel9", "defaultStatus": "affected", "versions": [{"version": "1783919486", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:13508", "name": "RHSA-2026:13508", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13545", "name": "RHSA-2026:13545", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42078", "name": "RHSA-2026:42078", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:42142", "name": "RHSA-2026:42142", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-12382", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489126", "name": "RHBZ#2489126", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-07-15T17:12:31.720Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-290: Authentication Bypass by Spoofing", "workarounds": [{"lang": "en", "value": "The following practices would help for avoiding exposure and mitigate this flaw:\n\n- Restrict network access to the non-mTLS EDA event stream route (/eda-event-streams/) at the firewall or load balancer level, allowing only trusted internal sources.\n- If mTLS-protected event streams are in use, ensure that only the /mtls/eda-event-streams/ route is accessible from untrusted networks.\n- Monitor EDA event stream activity for unexpected events_received counter increases that may indicate unauthorized event injection.\n- Review Envoy proxy logs for requests to the non-mTLS event stream route from unexpected source IPs."}], "timeline": [{"lang": "en", "time": "2026-06-16T10:01:29.314Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-07-15T17:12:31.720Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Chris Meyers (Red Hat)."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-07-21T04:16:26.499Z"}, "x_generator": {"engine": "cvelib 1.8.0"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-12382"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:34:11.503115Z", "id": "CVE-2026-12382", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:34:15.091Z"}}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59138", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-07-02T16:05:24.071Z", "datePublished": "2026-08-11T17:03:47.640Z", "dateUpdated": "2026-08-12T14:47:01.131Z"}, "containers": {"cna": {"title": "Microsoft Remote Registry Service Denial of Service Vulnerability", "datePublic": "2026-08-11T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*", "versionStartIncluding": "10.0.17763.0", "versionEndExcluding": "10.0.17763.9115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.17763.0", "versionEndExcluding": "10.0.17763.9115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.17763.0", "versionEndExcluding": "10.0.17763.9115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.20348.0", "versionEndExcluding": "10.0.20348.5499"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*", "versionStartIncluding": "10.0.19044.0", "versionEndExcluding": "10.0.19044.7663"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "10.0.19045.0", "versionEndExcluding": "10.0.19045.7663"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.26100.0", "versionEndExcluding": "10.0.26100.33296"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*", "versionStartIncluding": "10.0.26200.0", "versionEndExcluding": "10.0.26200.9168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*", "versionStartIncluding": "10.0.22631.0", "versionEndExcluding": "10.0.22631.7517"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "10.0.22631.0", "versionEndExcluding": "10.0.22631.7517"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*", "versionStartIncluding": "10.0.26100.0", "versionEndExcluding": "10.0.26100.9168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.26100.0", "versionEndExcluding": "10.0.26100.33296"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*", "versionStartIncluding": "10.0.28000.0", "versionEndExcluding": "10.0.28000.2704"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*", "versionStartIncluding": "10.0.14393.0", "versionEndExcluding": "10.0.14393.9418"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.14393.0", "versionEndExcluding": "10.0.14393.9418"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.14393.0", "versionEndExcluding": "10.0.14393.9418"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.2.9200.0", "versionEndExcluding": "6.2.9200.26280"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.2.9200.0", "versionEndExcluding": "6.2.9200.26280"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.3.9600.0", "versionEndExcluding": "6.3.9600.23338"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.3.9600.0", "versionEndExcluding": "6.3.9600.23338"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "10.0.14393.0", "lessThan": "10.0.14393.9418", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "10.0.17763.0", "lessThan": "10.0.17763.9115", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.19044.0", "lessThan": "10.0.19044.7663", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": ["32-bit Systems", "ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.19045.0", "lessThan": "10.0.19045.7663", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 version 23H2", "platforms": ["ARM64-based Systems"], "versions": [{"version": "10.0.22631.0", "lessThan": "10.0.22631.7517", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.22631.0", "lessThan": "10.0.22631.7517", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": ["ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.26100.0", "lessThan": "10.0.26100.9168", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 Version 25H2", "platforms": ["ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.26200.0", "lessThan": "10.0.26200.9168", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows 11 version 26H1", "platforms": ["ARM64-based Systems", "x64-based Systems"], "versions": [{"version": "10.0.28000.0", "lessThan": "10.0.28000.2704", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012", "platforms": ["x64-based Systems"], "versions": [{"version": "6.2.9200.0", "lessThan": "6.2.9200.26280", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "6.2.9200.0", "lessThan": "6.2.9200.26280", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": ["x64-based Systems"], "versions": [{"version": "6.3.9600.0", "lessThan": "6.3.9600.23338", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "6.3.9600.0", "lessThan": "6.3.9600.23338", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2016", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.14393.0", "lessThan": "10.0.14393.9418", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.14393.0", "lessThan": "10.0.14393.9418", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2019", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.17763.0", "lessThan": "10.0.17763.9115", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.17763.0", "lessThan": "10.0.17763.9115", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2022", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.20348.0", "lessThan": "10.0.20348.5499", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2025", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.26100.0", "lessThan": "10.0.26100.33296", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.26100.0", "lessThan": "10.0.26100.33296", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-476: NULL Pointer Dereference", "lang": "en-US", "type": "CWE", "cweId": "CWE-476"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-12T14:47:01.131Z"}, "references": [{"name": "Microsoft Remote Registry Service Denial of Service Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59138"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}}], "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2026-59138"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T20:38:31.668647Z", "id": "CVE-2026-59138", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T20:54:06.076Z"}}]}}, {"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-44227", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2023-09-27T06:25:00.435Z", "datePublished": "2024-04-17T09:26:28.699Z", "dateUpdated": "2026-08-12T17:32:59.440Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins/simple-file-list/", "defaultStatus": "unaffected", "packageName": "simple-file-list", "product": "Simple File List", "vendor": "Mitchell Bennis", "versions": [{"changes": [{"at": "6.1.10", "status": "unaffected"}], "lessThanOrEqual": "6.1.9", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Rafshanzani Suhada (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Mitchell Bennis Simple File List.<p>This issue affects Simple File List: from n/a through 6.1.9.</p>"}], "value": "Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:08:39.890Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/simple-file-list/wordpress-simple-file-list-plugin-6-1-8-arbitrary-file-deletion?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to\u00a06.1.10 or a higher version."}], "value": "Update to\u00a06.1.10 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File Deletion", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "x_gcve": [{"recordType": "advisory", "vulnId": "cve-2023-44227"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:32:43.832816Z", "id": "CVE-2023-44227", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:32:59.440Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:59:51.596Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/simple-file-list/wordpress-simple-file-list-plugin-6-1-8-arbitrary-file-deletion?_s_id=cve"}]}]}}]