CWE-918

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.19.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T20:11:46.316Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm"
        },
        {
          "name": "https://github.com/sparklemotion/nokogiri/pull/3752",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/pull/3752"
        },
        {
          "name": "https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8"
        },
        {
          "name": "https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/commit/e448ca2827a9198644610fb730259e12baacdeac"
        },
        {
          "name": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5"
        }
      ],
      "source": {
        "advisory": "GHSA-v995-44v6-5fqm",
        "discovery": "UNKNOWN"
      },
      "title": "Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-126062",
    "datePublished": "2026-11-10T20:11:46.316Z",
    "dateReserved": "2026-11-10T17:07:43.283Z",
    "dateUpdated": "2026-11-10T20:11:46.316Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "N-central",
          "vendor": "N-able",
          "versions": [
            {
              "lessThan": "26.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.\u003cp\u003eThis issue affects N-central: before 26.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery.\n\nThis issue affects N-central: before 26.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side request forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:24:33.606Z",
        "orgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
        "shortName": "N-able"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://me.n-able.com/s/security-advisory/aArVy0000002io9KAA/cve2026125881-schemahint-ssrf-via-service-import-schema-validation"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Schema-hint SSRF via service import schema validation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
    "assignerShortName": "N-able",
    "cveId": "CVE-2026-125881",
    "datePublished": "2026-11-10T21:24:33.606Z",
    "dateReserved": "2026-11-10T12:55:11.705Z",
    "dateUpdated": "2026-11-10T21:24:33.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "sourcecache"
          ],
          "product": "misp-modules",
          "programFiles": [
            "misp_modules/modules/expansion/sourcecache.py"
          ],
          "repo": "https://github.com/MISP/misp-modules",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "3.0.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:misp:misp_modules:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.13",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "elhoim"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type \u0027link\u0027 or \u0027url\u0027 submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 Exploiting SSRF"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-11-10T11:02:25Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T15:45:50.479Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets."
        }
      ],
      "title": "MISP sourcecache module SSRF allows fetching arbitrary internal URLs via attribute enrichment",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The MISP server is assumed to be reachable over the network and that an authenticated user with attribute-creation permissions can submit link/url attributes; no specific MISP version or authentication model is stated in the patch.",
                  "CVSS PR:L assumes a low-privilege authenticated MISP user can create attributes; if MISP requires higher-level permissions, PR could be H.",
                  "CVSS SI:N assumes the archiving function only performs read (GET) requests; if it can issue state-changing methods, SI could be elevated.",
                  "SSVC technical_impact \u0027partial\u0027 is the least-assumptive choice; if cloud metadata endpoint access leads to full credential theft and infrastructure takeover, impact could be \u0027total\u0027.",
                  "The CAPEC-12 mapping is high-confidence based on the explicit SSRF description in the commit message and the code changes; no uncertainty is expected.",
                  "No specific affected or fixed version numbers are provided in the patch metadata; version boundaries are marked as unspecified.",
                  "The is_global check in Python\u0027s ipaddress module covers loopback, private, link-local, and other non-global ranges, but DNS rebinding between the check and the actual fetch is not addressed by this patch and could remain a residual risk."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The patch explicitly describes and remediates an SSRF: an attacker-supplied URL causes the MISP server to fetch internal resources (loopback, cloud metadata) and return the data. CAPEC-12 is the direct and most specific attack pattern for this scenario. No uncertainty is noted; the commit message and code changes align precisely with this pattern."
                  }
                ],
                "commit": "7cb31e96a1f59bec9afbc087b27b26d9986c6841",
                "confidence": "high",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "elhoim"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The MISP API is network-accessible. AC:L: Crafting a URL attribute with an internal address is trivial. AT:N: No special adversary technique is required. PR:L: An authenticated MISP user with attribute-creation rights is needed. UI:N: No victim interaction beyond the attacker\u0027s own API call. VC/VI/VA:N: The MISP server\u0027s own confidentiality, integrity, and availability are not directly compromised. SC:H: The subsequent component (internal services, cloud metadata) suffers high confidentiality impact because its data is exfiltrated into the MISP event. SI:N: The module only performs GET-style fetches; no evidence of integrity impact on subsequent components. SA:N: No availability impact on subsequent components is indicated.",
                "draft": false,
                "fixSummary": "The fix introduces a URL validation gate (is_safe_url) that is invoked before any archiving request is made. The function restricts the scheme to http or https, resolves the hostname via DNS, and verifies that every resolved IP address is globally routable (i.e., not loopback, private, link-local, or otherwise non-global). If any check fails, the module returns an error and the fetch is never performed, preventing the server from being directed to internal or non-HTTP targets.",
                "generatedAt": "2026-11-10T11:02:25.004287Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "potentialErrors": [],
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 7,
                      "confidence": "high",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "736974194693496cbcfe68e570862a9e221a43f5f6820180e20958b617ebb97c",
                "patchSummary": "Adds imports for ipaddress and socket. Introduces a new is_safe_url(url) function that parses the URL, rejects non-http/https schemes, resolves the hostname with socket.getaddrinfo, and rejects the URL if any resolved address fails ipaddress.ip_address().is_global(). In the handler() function, a guard clause calls is_safe_url(tocache) before invoking __archiveLink and returns an error dict if the URL is not safe. Two new unit tests verify that http://127.0.0.1:6379/ and file:///etc/passwd are blocked and that the archive function is never called.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "7cb31e96a1f59bec9afbc087b27b26d9986c6841",
                    "date": "Fri, 16 Oct 2026 22:27:37 +0000",
                    "patchSha256": "736974194693496cbcfe68e570862a9e221a43f5f6820180e20958b617ebb97c",
                    "retrievedAt": "2026-11-10T11:01:44.851219Z",
                    "source": "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch",
                    "sourceUrl": "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch",
                    "subject": "fix: [sourcecache] validate URLs before archiving to block"
                  }
                ],
                "source": "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-11-10T11:02:25Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [sourcecache] validate URLs before archiving to block",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The module accepts a user-supplied URL and issues a server-side HTTP request to it without validating the target, allowing an attacker to direct requests to internal or non-HTTP resources. This is a textbook SSRF."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The root cause is the absence of any validation on the URL attribute value before it is used as a request target. The fix adds scheme, hostname, and IP-address validation, confirming the missing input validation was the defect."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (7cb31e96a1f59bec9afbc087b27b26d9986c6841): fix: [sourcecache] validate URLs before archiving to block",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch"
                    ],
                    "timestamp": "2026-10-16T22:27:37Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Patch retrieved from the supplied URL; retrieval time is used as the default availability time.",
                    "id": "evt-fix-available-1",
                    "references": [
                      "https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841.patch"
                    ],
                    "timestamp": "2026-11-10T11:01:44.851219Z",
                    "type": "fix-available"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20273"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-125871",
    "datePublished": "2026-11-10T12:57:57.142Z",
    "dateReserved": "2026-11-10T12:50:34.525Z",
    "dateUpdated": "2026-11-10T15:45:50.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125367",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:18:44.659324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:06:28.333Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/picosh/pico",
          "product": "pico",
          "vendor": "picosh",
          "versions": [
            {
              "lessThanOrEqual": "4.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:39.868Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #229",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/picosh/pico/issues/229"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/picosh/pico"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/picosh/pico/commit/48a85d6"
        },
        {
          "name": "VulnCheck Advisory: Pico through 4.1.2 SSRF in Feeds Service via run SSH Command",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pico-through-4.1.2-ssrf-in-feeds-service-via-run-ssh-command"
        }
      ],
      "title": "Pico through 4.1.2 SSRF in Feeds Service via run SSH Command",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125367",
    "datePublished": "2026-11-09T23:27:39.868Z",
    "dateReserved": "2026-11-09T22:03:02.822Z",
    "dateUpdated": "2026-11-10T19:06:28.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/asciimoo/omnom",
          "product": "omnom",
          "vendor": "asciimoo",
          "versions": [
            {
              "lessThanOrEqual": "0.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:39.142Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #67",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/asciimoo/omnom/issues/67"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/asciimoo/omnom"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/asciimoo/omnom/blob/v0.9.0/feed/feed.go#L421"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/asciimoo/omnom/commit/01c45510ab06c51bc952901514735b457a492f10"
        },
        {
          "name": "VulnCheck Advisory: Omnom through 0.9.0 SSRF via Add Feed /add_feed Route",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/omnom-through-0.9.0-ssrf-via-add-feed-add-feed-route"
        }
      ],
      "title": "Omnom through 0.9.0 SSRF via Add Feed /add_feed Route",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125366",
    "datePublished": "2026-11-09T23:27:39.142Z",
    "dateReserved": "2026-11-09T22:03:02.429Z",
    "dateUpdated": "2026-11-09T23:27:39.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:18:42.429962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:06:35.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MikroDash",
          "repo": "https://github.com/SecOps-7/MikroDash",
          "vendor": "SecOps-7",
          "versions": [
            {
              "lessThan": "0.8.79",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-11-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:36.416Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-xf3p-2j7c-6hg4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/SecOps-7/MikroDash/security/advisories/GHSA-xf3p-2j7c-6hg4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/SecOps-7/MikroDash/commit/4a40d104faa9f6d7b7539a3ce78fb91509d40cce"
        },
        {
          "name": "MikroDash v0.8.79 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/SecOps-7/MikroDash/releases/tag/v0.8.79"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/SecOps-7/MikroDash/blob/v0.8.78/internal/server/notify_channels_api.go#L457"
        },
        {
          "name": "VulnCheck Advisory: MikroDash before 0.8.79 SSRF via Personal Notification Channels",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mikrodash-before-0.8.79-ssrf-via-personal-notification-channels"
        }
      ],
      "title": "MikroDash before 0.8.79 SSRF via Personal Notification Channels",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125363",
    "datePublished": "2026-11-09T23:27:36.416Z",
    "dateReserved": "2026-11-09T22:03:01.310Z",
    "dateUpdated": "2026-11-10T19:06:35.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125359",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:18:39.804257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:06:45.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "mediary-scout",
          "vendor": "fancydirty",
          "versions": [
            {
              "lessThan": "2026.11.05",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-11-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou() to send server-side POST requests to internal hosts and use distinct error responses as an oracle for internal host and port discovery."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:33.452Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #366",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/fancydirty/mediary-scout/issues/366"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/fancydirty/mediary-scout"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/fancydirty/mediary-scout/blob/v2026.10.29/apps/web/lib/pansou-probe.ts#L18-L34"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/fancydirty/mediary-scout/commit/9cb9ab5eea492bc8f61f5c4d63f9c6b6800f7e1f"
        },
        {
          "name": "mediary-scout v2026.11.05 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/fancydirty/mediary-scout/releases/tag/v2026.11.05"
        },
        {
          "name": "VulnCheck Advisory: Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mediary-scout-before-2026.11.05-ssrf-via-pansou-search-source-setting"
        }
      ],
      "title": "Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125359",
    "datePublished": "2026-11-09T23:27:33.452Z",
    "dateReserved": "2026-11-09T22:02:59.877Z",
    "dateUpdated": "2026-11-10T19:06:45.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125115",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:18:37.517561Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:06:56.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "novu",
          "vendor": "novuhq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.17.0"
            }
          ]
        },
        {
          "product": "application-generic",
          "vendor": "@novu",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T22:16:35.104Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq"
        },
        {
          "name": "https://github.com/novuhq/novu/pull/11197",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/novuhq/novu/pull/11197"
        },
        {
          "name": "https://github.com/novuhq/novu/releases/tag/v3.17.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/novuhq/novu/releases/tag/v3.17.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vg6v-j97m-h5xq",
        "discovery": "UNKNOWN"
      },
      "title": "Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations \u2014 affects Workflow HTTP request step + Webhook filter condition"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125115",
    "datePublished": "2026-11-09T22:16:35.104Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T19:06:56.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "novu",
          "vendor": "novuhq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling validateUrlSsrf. Evaluating a workflow condition can therefore make the worker send a POST request to a private or link-local service and return the response data for condition evaluation. The response is stored in execution details and exposed through GET /execution-details, which can disclose credentials from POST-capable metadata services or data from internal services, although metadata endpoints that require GET are not reachable through this path. This issue is fixed in version 3.15.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T22:14:57.669Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/novuhq/novu/security/advisories/GHSA-4x48-cgf9-q33f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/novuhq/novu/security/advisories/GHSA-4x48-cgf9-q33f"
        },
        {
          "name": "https://github.com/novuhq/novu/pull/10457",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/novuhq/novu/pull/10457"
        },
        {
          "name": "https://github.com/novuhq/novu/commit/87d965eb88340ac7cd262dd52c8015acd092dc68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/novuhq/novu/commit/87d965eb88340ac7cd262dd52c8015acd092dc68"
        },
        {
          "name": "https://github.com/novuhq/novu/releases/tag/v3.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/novuhq/novu/releases/tag/v3.15.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4x48-cgf9-q33f",
        "discovery": "UNKNOWN"
      },
      "title": "Novu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125114",
    "datePublished": "2026-11-09T22:14:57.669Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-09T22:14:57.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "sql-gateway Endpoint"
          ],
          "product": "Dinky",
          "vendor": "DataLinkDC",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            },
            {
              "status": "affected",
              "version": "1.2.2"
            },
            {
              "status": "affected",
              "version": "1.2.3"
            },
            {
              "status": "affected",
              "version": "1.2.4"
            },
            {
              "status": "affected",
              "version": "1.2.5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "lucasg2g (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T02:45:23.269Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-432891 | DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/432891"
        },
        {
          "name": "VDB-432891 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/432891/cti"
        },
        {
          "name": "CVE-2026-124558 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124558"
        },
        {
          "name": "Submit #1035494 | DataLinkDC dinky (dinky-admin) up to and including released tag v1.2.5 (reviewed at commit ce7678eaa13722541f7d1eeda7ffbf8c9f753e20; v1.2.5 was the newest release at the time of review) Server-Side Request Forgery with interaction/read-back",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1035494"
        },
        {
          "tags": [
            "broken-link"
          ],
          "url": "https://github.com/DataLinkDC/dinky/security/advisories/GHSA-x4hx-f425-mrx6"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/DataLinkDC/dinky/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-08T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-08T15:40:44.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124558",
    "datePublished": "2026-11-09T02:45:23.269Z",
    "dateReserved": "2026-11-08T14:17:42.095Z",
    "dateUpdated": "2026-11-09T02:45:23.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}