# Recent vulnerabilities from GNA-1 (CIRCL) ## [gcve-1-2026-20208](https://vulnerability.circl.lu/vuln/gcve-1-2026-20208) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Reyee RG-ES208GC", "vendor": "Ruijie", "versions": [ { "lessThanOrEqual": "999999", "status": "unknown", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "other", "value": "Paul Jung" }, { "lang": "en", "type": "finder", "value": "The unknown scanner from China Mobile network" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Heap-based Buffer Overflow vulnerability in Ruijie Reyee RG-ES208GC (at least) allows Overflow Buffers.

This issue affects at least RG-ES208GC - Reyee - Ruijie equipments.

Discovered on a honeypot operated by CIRCL.

" } ], "value": "Heap-based Buffer Overflow vulnerability in Ruijie Reyee RG-ES208GC (at least) allows Overflow Buffers.This issue affects at least RG-ES208GC - Reyee - Ruijie equipments.\n\n\nDiscovered on a honeypot operated by CIRCL." } ], "impacts": [ { "capecId": "CAPEC-100", "descriptions": [ { "lang": "en", "value": "CAPEC-100 Overflow Buffers" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] }, { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "Local exploitation" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "product" ], "url": "https://reyee.ruijie.com/en-global/products/reyee-switch/smart-cctv-switch/es208gc/" } ], "source": { "discovery": "UNKNOWN" }, "title": "Switch RG-ES208GC - Reyee - Ruijie equipments", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20208", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2026-08-24T09:14:00.000Z", "dateUpdated": "2026-08-24T10:23:30.515440Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20208" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20162](https://vulnerability.circl.lu/vuln/gcve-1-2026-20162) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "pandora", "repo": "https://github.com/pandora-analysis/pandora", "vendor": "pandora-analysis", "versions": [ { "lessThanOrEqual": "1.12.5", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Raphael Vinot" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter.

\n

An attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process.

\n

The vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets.

\n

The weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory.


" } ], "value": "Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract() without applying an extraction filter.\n\n\nAn attacker able to submit a specially crafted TAR archive containing malicious member paths, such as paths using ../ sequences or absolute paths, could cause extracted files to be written outside the intended extraction directory. This may allow the attacker to overwrite files accessible to the Pandora worker process and could potentially result in application compromise, arbitrary code execution, or denial of service depending on the files targeted and the privileges of the Pandora process.\n\n\nThe vulnerability is corrected by using Python's filter='data' extraction filter, which rejects or sanitizes dangerous TAR members, including paths that escape the destination directory and unsafe link targets. \n\n\nThe weakness corresponds to MITRE's general path traversal category, which includes archive extraction cases where attacker-controlled filenames cause files to be written outside the intended directory." } ], "impacts": [ { "capecId": "CAPEC-126", "descriptions": [ { "lang": "en", "value": "CAPEC-126 Path Traversal" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/pandora-analysis/pandora/commit/186b58d41e04248a154d274fffb5813e7fa2012e" } ], "source": { "discovery": "EXTERNAL" }, "title": "Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20162", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20162", "datePublished": "2026-08-15T21:38:55.588915Z", "dateUpdated": "2026-08-15T21:39:05.458138Z", "cveId": "CVE-2026-74764", "dateReserved": "2026-08-15T21:39:04.877Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20026](https://vulnerability.circl.lu/vuln/gcve-1-2026-20026) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "KGUARD_firmware", "vendor": "KGUARD", "versions": [ { "lessThanOrEqual": "*", "status": "unknown", "version": "0", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR.

The vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0).

The affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions

The exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor.
" } ], "value": "Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker with network access to the affected service can execute arbitrary system commands on the device, potentially resulting in complete compromise of the DVR.\n\nThe vulnerability is known to have been exploited in the wild by the Mirai_ptea (Rimasuta) and Mirai_aurora botnets for malware propagation and subsequent DDoS activity. The vulnerability was reported to affect firmware dating from 2016, while firmware released after 2017 appears to mitigate the issue by restricting the affected service to the localhost interface (127.0.0.1) instead of exposing it on all interfaces (0.0.0.0).\n\nThe affected-device list reported by Netlab includes many D1004NR, D1008NR, D1016NR, D1104, D1104NR, D1108NR, D1116NR, D1132NR, D2116NR, D97xx, D98xx, and D99xx variants and several associated hardware revisions\n\n\nThe exploit is included in some version of rapperbot and exploited in 2026. This assignment has been made to document the active exploitation and lack of documentation from the vendor." } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-1188", "description": "CWE-1188 Insecure Default Initialization of Resource", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "technical-description" ], "url": "https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/" } ], "source": { "discovery": "UNKNOWN" }, "title": "KGUARD DVR unauthenticated remote command execution vulnerability", "x_gcve": [ { "recordType": "advisory", "vulnId": "gcve-1-2026-20026" } ], "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-87827", "datePublished": "2026-09-09T10:27:00.000Z", "dateReserved": "2026-09-09T10:41:00.000Z", "dateUpdated": "2026-09-09T10:53:31.849724Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20026" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0021](https://vulnerability.circl.lu/vuln/gcve-1-2026-0021) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "FlexPLM", "vendor": "windchill", "versions": [ { "lessThanOrEqual": "13.0.3.0", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "PDMLink", "vendor": "Windchill", "versions": [ { "lessThanOrEqual": "13.0.3.0", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in windchill FlexPLM, Windchill PDMLink.

This issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0.

" } ], "value": "Improper Control of Generation of Code ('Code Injection') vulnerability in windchill FlexPLM, Windchill PDMLink.This issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0." } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://support.eacpds.com/hc/en-us/article_attachments/47430019070996" }, { "tags": [ "vendor-advisory" ], "url": "https://www.ptc.com/en/support/article/CS466318?_gl=1*196gmri*_gcl_au*Njc4ODc0NTE4LjE3NzQxNzI5NTc.*_ga*MTY0OTgyOTM1NC4xNzc0MTcyOTU2*_ga_7NMP2MSYPM*czE3NzQxNzI5NTYkbzEkZzAkdDE3NzQxNzI5ODQkajMyJGwwJGgw&as=0" } ], "source": { "discovery": "UNKNOWN" }, "title": "Critical RCE Vulnerability reported in Windchill", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0021", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0021", "datePublished": "2026-03-23T12:30:40.249187Z", "dateUpdated": "2026-03-23T12:30:40.249187Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-03-23T12:30:40.249187Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0020](https://vulnerability.circl.lu/vuln/gcve-1-2026-0020) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "D1000", "vendor": "Eir", "versions": [ { "lessThanOrEqual": "2.00", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "datePublic": "2016-12-09T23:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Improper Input Validation vulnerability in Eir D1000 allows Input Data Manipulation.

This issue affects D1000: through  2.00(AADU.5)_20150909

" } ], "value": "Improper Input Validation vulnerability in Eir D1000 allows Input Data Manipulation.This issue affects D1000: through  2.00(AADU.5)_20150909" } ], "impacts": [ { "capecId": "CAPEC-153", "descriptions": [ { "lang": "en", "value": "CAPEC-153 Input Data Manipulation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "media-coverage" ], "url": "https://threatprotect.qualys.com/2016/12/14/remote-code-execution-attack-against-eircom-d1000-router/" } ], "source": { "discovery": "UNKNOWN" }, "title": "Remote Code Execution Attack Against Eircom D1000 Router", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0020", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2026-03-11T14:12:00.000Z", "dateUpdated": "2026-03-11T14:23:24.609831Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0020", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-03-11T14:12:30.597173Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-03-11T14:21:34.097103Z" ], [ "cedric.bonhomme@circl.lu", "2026-03-11T14:23:24.609831Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0008](https://vulnerability.circl.lu/vuln/gcve-1-2026-0008) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "gpg-agent", "vendor": "gnupg", "versions": [ { "lessThan": "2.5.17", "status": "affected", "version": "2.5.13" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "OpenAI Security Research" }, { "lang": "en", "type": "remediation developer", "value": "Werner Koch" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped
\nsession key (AES Key Wrap ciphertext) can cause a stack buffer overflow in
\ngpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an
\nunbounded session key length derived from attacker-controlled ciphertext
\nand used as the AES Key Wrap output length when decrypting into a
\nfixed-size stack buffer. libgcrypt’s AES-KW unwrap copies
\nattacker-controlled bytes into the caller-provided output buffer before
\nperforming integrity checks, so the stack overflow occurs even if later CMS
\nor key-wrap integrity validation fails.
" } ], "value": "A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped\n\nsession key (AES Key Wrap ciphertext) can cause a stack buffer overflow in\n\ngpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an\n\nunbounded session key length derived from attacker-controlled ciphertext\n\nand used as the AES Key Wrap output length when decrypting into a\n\nfixed-size stack buffer. libgcrypt’s AES-KW unwrap copies\n\nattacker-controlled bytes into the caller-provided output buffer before\n\nperforming integrity checks, so the stack overflow occurs even if later CMS\n\nor key-wrap integrity validation fails." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "issue-tracking" ], "url": "https://dev.gnupg.org/T8044" } ], "source": { "discovery": "UNKNOWN" }, "title": "gpg-agent stack buffer overflow in pkdecrypt using KEM", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0008", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-0008", "datePublished": "2026-01-28T13:48:12.350509Z", "dateUpdated": "2026-01-28T13:48:12.350509Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-01-28T13:48:12.350509Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0007](https://vulnerability.circl.lu/vuln/gcve-1-2026-0007) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "InetUtils", "vendor": "gnu", "versions": [ { "lessThanOrEqual": "2.7", "status": "affected", "version": "1.9.3" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Kyu Neushwaistein aka Carlos Cortes Alvarez" }, { "lang": "en", "type": "remediation developer", "value": "Simon Josefsson" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
The telnetd server invokes /usr/bin/login (normally running as root)\npassing the value of the USER environment variable received from the\nclient as the last parameter.\n\nIf the client supply a carefully crafted USER environment value being\nthe string \"-f root\", and passes the telnet(1) -a or --login parameter\nto send this USER environment to the server, the client will be\nautomatically logged in as root bypassing normal authentication\nprocesses.\n\nThis happens because the telnetd server do not sanitize the USER\nenvironment variable before passing it on to login(1), and login(1)\nuses the -f parameter to by-pass normal authentication.\n\nSeverity: High\n\nVulnerable versions: GNU InetUtils since version 1.9.3 up to and\nincluding version 2.7.

" } ], "value": "The telnetd server invokes /usr/bin/login (normally running as root)\npassing the value of the USER environment variable received from the\nclient as the last parameter.\n\nIf the client supply a carefully crafted USER environment value being\nthe string \"-f root\", and passes the telnet(1) -a or --login parameter\nto send this USER environment to the server, the client will be\nautomatically logged in as root bypassing normal authentication\nprocesses.\n\nThis happens because the telnetd server do not sanitize the USER\nenvironment variable before passing it on to login(1), and login(1)\nuses the -f parameter to by-pass normal authentication.\n\nSeverity: High\n\nVulnerable versions: GNU InetUtils since version 1.9.3 up to and\nincluding version 2.7." } ], "impacts": [ { "capecId": "CAPEC-13", "descriptions": [ { "lang": "en", "value": "CAPEC-13 Subverting Environment Variable Values" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://seclists.org/oss-sec/2026/q1/89" }, { "tags": [ "related" ], "url": "https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c288b87139a0da8249d0a408c4dfb87" } ], "source": { "discovery": "UNKNOWN" }, "title": "GNU InetUtils Security Advisory: remote authentication by-pass in telnetd", "x_gcve": [ { "recordType": "advisory", "relationships": [ { "destId": "CVE-2007-0882", "type": "related" }, { "destId": "CVE-1999-0113", "type": "related" } ], "vulnId": "GCVE-1-2026-0007" } ], "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-24061", "datePublished": "2026-01-20T20:57:00.000Z", "dateUpdated": "2026-01-26T16:32:40.831364Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0007", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-01-20T20:57:01.702747Z" ], [ "cedric.bonhomme@circl.lu", "2026-01-23T10:57:36.157223Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-01-26T16:26:04.438979Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-01-26T16:26:56.813944Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-01-26T16:32:40.831364Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0002](https://vulnerability.circl.lu/vuln/gcve-1-2026-0002) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "ffmpeg", "vendor": "ffmpeg", "versions": [ { "status": "affected" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Heap-buffer-overflow in EXIF writer for extra IFD tags | Pwno


We recently found a cool four-bytes heap-buffer-overflow in FFmpeg's `avcodec/exif` during the processing of IFDs _(Image File Directory)._ This affects `.png`, `.jpg`, `.webp`, `.avif` … the formats we use most often. The cause of this bug is very interesting, and I don’t want to spoil it here; I want you to find out.

It’s also a short in-depth dive of FFmpeg internal workings of EXIFs, something we use so often. So even if you’re not really into memory bugs, this can be a cool way to learn how it works under the hood.



" } ], "value": "Heap-buffer-overflow in EXIF writer for extra IFD tags | Pwno\n\n\nWe recently found a cool four-bytes heap-buffer-overflow in FFmpeg's `avcodec/exif` during the processing of IFDs _(Image File Directory)._ This affects `.png`, `.jpg`, `.webp`, `.avif` … the formats we use most often. The cause of this bug is very interesting, and I don’t want to spoil it here; I want you to find out.\n\nIt’s also a short in-depth dive of FFmpeg internal workings of EXIFs, something we use so often. So even if you’re not really into memory bugs, this can be a cool way to learn how it works under the hood." } ], "impacts": [ { "capecId": "CAPEC-100", "descriptions": [ { "lang": "en", "value": "CAPEC-100 Overflow Buffers" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "technical-description" ], "url": "https://bugs.pwno.io/0014" }, { "tags": [ "patch" ], "url": "https://github.com/FFmpeg/FFmpeg/commit/4bfac71ecd96488dd2dcd5649e08edb039a17a8b" } ], "source": { "discovery": "UNKNOWN" }, "title": "Heap-buffer-overflow in EXIF writer for extra IFD tags", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0002", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2026-01-02T19:50:00.000Z", "dateUpdated": "2026-01-02T20:05:27.269877Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0002", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-01-02T19:50:03.961640Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-01-02T19:53:50.510087Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-01-02T20:05:27.269877Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0032](https://vulnerability.circl.lu/vuln/gcve-1-2025-0032) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "firebox", "vendor": "watchguard", "versions": [ { "status": "affected" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

The default \nconfiguration of WatchGuard Firebox devices through 2025-09-10 allows \nadministrative access via SSH on port 4118 with the readwrite password \nfor the admin account.


GNA (CIRCL): We consider this being a vulnerability and confirm available exposed devices in our constituency." } ], "value": "The default \nconfiguration of WatchGuard Firebox devices through 2025-09-10 allows \nadministrative access via SSH on port 4118 with the readwrite password \nfor the admin account.\n\n\n\n\nGNA (CIRCL): We consider this being a vulnerability and confirm available exposed devices in our constituency." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "description": "https://github.com/advisories/ghsa-63mf-v9cc-6mhm", "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://" } ], "source": { "discovery": "UNKNOWN" }, "title": "The default configuration of WatchGuard Firebox devices through 2025-09-10 allows administrative access via SSH on port 4118 with the readwrite password for the admin account.", "x_gcve": [ { "recordType": "advisory", "relationships": [ { "destId": "CVE-2025-59396", "type": "opposes" } ], "vulnId": "GCVE-1-2025-0032" } ], "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2025-59396", "datePublished": "2025-12-03T16:25:00.000Z", "dateUpdated": "2025-12-19T13:48:34.570799Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0032", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-12-03T16:25:59.255392Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-03T16:27:36.683434Z" ], [ "cedric.bonhomme@circl.lu", "2025-12-19T13:48:34.570799Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0004](https://vulnerability.circl.lu/vuln/gcve-1-2025-0004) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "vulnerability-lookup", "vendor": "CIRCL", "versions": [ { "lessThan": "2.16.0", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "@Wachizungu" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Comments, Bundles, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models." } ], "value": "A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Comments, Bundles, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/afa12347f1461d9481eba75ac19897e80a9c7434" } ], "source": { "discovery": "UNKNOWN" }, "title": "XSS in Comments, Bundles, and Sightings component of vulnerability-lookup", "x_gcve": [ { "recordType": "advisory", "vulnId": "gcve-1-2025-0004" } ], "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "cve-2025-60249", "datePublished": "2025-09-25T14:10:00.000Z", "dateUpdated": "2026-09-21T07:41:13.477505Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0004", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-09-25T14:10:26.445421Z" ], [ "cedric.bonhomme@circl.lu", "2025-11-19T10:16:47.656802Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20078](https://vulnerability.circl.lu/vuln/gcve-1-2026-20078) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "repo": "https://github.com/MISP/MISP/", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.45", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "elhoim (David André)" }, { "lang": "en", "type": "tool", "value": "Claude Opus 5 (1M context)" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials.

The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate its credential validation checks. As a result, empty or non-string values could reach the underlying authentication mechanisms.

In the LDAP authentication path, an attacker able to identify a valid directory user's email address could submit an empty password. The empty credential could be passed to ldap_bind(), where an LDAP server accepting unauthenticated binds may return a successful result for a valid distinguished name combined with an empty password. MISP could consequently treat the attacker as the corresponding authenticated directory user without verification of the user's password.

The issue also affected the LinOTP authentication component. Invalid credential types were not rejected before being processed, and when mixed authentication was enabled, an empty password could be checked against a locally stored MISP password hash. LDAP-provisioned MISP accounts could additionally be created with an empty local password because account creation skipped normal validation, resulting in a hash corresponding to an empty password. This could permit authentication through the local fallback mechanism when such an account was no longer resolved through LDAP.

Successful exploitation could allow a remote unauthenticated attacker to impersonate an existing MISP user. If the targeted account has administrative or other privileged permissions, the attacker could gain corresponding access to sensitive threat-intelligence data, modify or delete information, alter configuration, or perform other privileged operations.

The patch resolves the vulnerability by requiring authentication identifiers and passwords to be valid strings, rejecting empty passwords where they are not explicitly permitted, and assigning a randomly generated local password to LDAP-provisioned accounts instead of storing a hash derived from an empty password.


" } ], "value": "MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials.\n\nThe custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate implementation but did not replicate its credential validation checks. As a result, empty or non-string values could reach the underlying authentication mechanisms.\n\nIn the LDAP authentication path, an attacker able to identify a valid directory user's email address could submit an empty password. The empty credential could be passed to ldap_bind(), where an LDAP server accepting unauthenticated binds may return a successful result for a valid distinguished name combined with an empty password. MISP could consequently treat the attacker as the corresponding authenticated directory user without verification of the user's password.\n\nThe issue also affected the LinOTP authentication component. Invalid credential types were not rejected before being processed, and when mixed authentication was enabled, an empty password could be checked against a locally stored MISP password hash. LDAP-provisioned MISP accounts could additionally be created with an empty local password because account creation skipped normal validation, resulting in a hash corresponding to an empty password. This could permit authentication through the local fallback mechanism when such an account was no longer resolved through LDAP.\n\nSuccessful exploitation could allow a remote unauthenticated attacker to impersonate an existing MISP user. If the targeted account has administrative or other privileged permissions, the attacker could gain corresponding access to sensitive threat-intelligence data, modify or delete information, alter configuration, or perform other privileged operations.\n\nThe patch resolves the vulnerability by requiring authentication identifiers and passwords to be valid strings, rejecting empty passwords where they are not explicitly permitted, and assigning a randomly generated local password to LDAP-provisioned accounts instead of storing a hash derived from an empty password." } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 9.5, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-521", "description": "CWE-521 Weak Password Requirements", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/0ee058548" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20078", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20078", "datePublished": "2026-09-03T13:59:17.284986Z", "dateUpdated": "2026-09-03T13:59:30.774395Z", "cveId": "CVE-2026-85216", "dateReserved": "2026-09-03T13:59:30.683Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20157](https://vulnerability.circl.lu/vuln/gcve-1-2026-20157) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Neo", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Neo 2", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "DJI Flip", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.1200", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Air 3", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.1600", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Air 3S", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Avata 2", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0400", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Avata 360", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0300", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mavic 3", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.1400", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mavic 3 Classic", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0800", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mavic 3 Pro", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.01.0700", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mavic 4 Pro", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mini 2", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.07.0200", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mini 3", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0500", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mini 3 Pro", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0900", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mini 4 Pro", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.1100", "status": "affected", "version": "0", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "Mini 5 Pro", "vendor": "DJI", "versions": [ { "lessThanOrEqual": "01.00.0600", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Abdelrahman Yousef" }, { "lang": "en", "type": "finder", "value": "Dr. Jordan Samhi" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.

* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network
* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.
* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely
* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed
* A BLE sniffer and presence during one normal DJI Fly connection are needed

Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.

Remediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading." } ], "value": "DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone over BLE, including the Wi-Fi credentials. An attacker within BLE range can passively sniff this traffic and recover the credentials in cleartext, including the drone's Wi-Fi PSK, SSID, and trusted identifier UUID. Obtaining these credentials allows the attacker to join the drone's internal Wi-Fi network, interact with network services exposed by the drone, and decrypt Wi-Fi traffic exchanged between the drone and the legitimate user.\n\n* An attacker within BLE range recovers the Wi-Fi SSID and PSK in cleartext, and can then join the drone's network \n* The same capture also exposes the session UUID identifier, which is the only thing the drone uses to tell a trusted client from an unknown one, so the attacker can replay it and skip the physical confirmation of new connected devices.\n* The credentials do not change between sessions unless the operator manually resets the Wi-Fi settings, so one capture stays valid indefinitely\n* The attack is fully passive, with nothing transmitted and no connection made, so neither the operator nor the drone has any indication the session was observed\n* A BLE sniffer and presence during one normal DJI Fly connection are needed\n\nAffected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.\n\nRemediation requires a firmware update from the vendor. There is no user-side mitigation that fully addresses the vulnerability without upgrading." } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-311", "description": "CWE-311 Missing Encryption of Sensitive Data", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "technical-description" ], "url": "https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en" } ], "source": { "discovery": "UNKNOWN" }, "title": "Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLE", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20157", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-77812", "datePublished": "2026-08-21T14:06:00.000Z", "dateReserved": "2026-08-21T14:06:00.000Z", "dateUpdated": "2026-08-24T07:28:26.616826Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20157" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20150](https://vulnerability.circl.lu/vuln/gcve-1-2026-20150) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "ransomlook", "repo": "https://github.com/RansomLook/RansomLook", "vendor": "ransomlook", "versions": [ { "lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Fafner [_KeyZee_]" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to configuration-management functionality.

An authenticated low-privileged user able to access the endpoint can submit crafted configuration values that are written directly to the application's config/generic.json file. The affected functionality permits modification of configuration sections including notification, LDAP, SMTP, and general application settings. Successful exploitation could therefore allow an attacker to alter security-sensitive application behavior, redirect integrations or notifications, modify authentication-related configuration, disrupt external services, or render the RansomLook installation unavailable.

The configuration editor also operated on a configuration file containing sensitive values such as passwords, tokens, secrets, and API keys. Although the affected version contains logic intended to prevent recognized secret values from being returned to the browser, exposing configuration management through insufficiently authorized web functionality significantly increases the impact of a compromised or low-privileged account.

The patch resolves the issue by completely removing the /admin/config route and associated configuration-editing interface, preventing application configuration from being modified through the web UI.


" } ], "value": "RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to configuration-management functionality.\n\nAn authenticated low-privileged user able to access the endpoint can submit crafted configuration values that are written directly to the application's config/generic.json file. The affected functionality permits modification of configuration sections including notification, LDAP, SMTP, and general application settings. Successful exploitation could therefore allow an attacker to alter security-sensitive application behavior, redirect integrations or notifications, modify authentication-related configuration, disrupt external services, or render the RansomLook installation unavailable.\n\nThe configuration editor also operated on a configuration file containing sensitive values such as passwords, tokens, secrets, and API keys. Although the affected version contains logic intended to prevent recognized secret values from being returned to the browser, exposing configuration management through insufficiently authorized web functionality significantly increases the impact of a compromised or low-privileged account.\n\nThe patch resolves the issue by completely removing the /admin/config route and associated configuration-editing interface, preventing application configuration from being modified through the web UI." } ], "impacts": [ { "capecId": "CAPEC-122", "descriptions": [ { "lang": "en", "value": "CAPEC-122 Privilege Abuse" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/RansomLook/RansomLook/commit/d411ff51446e9e8b04e15567b46d53e86a3116dd" } ], "source": { "discovery": "UNKNOWN" }, "title": "RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20150", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20150", "datePublished": "2026-08-24T14:03:49.792546Z", "dateUpdated": "2026-08-24T14:04:08.948852Z", "cveId": "CVE-2026-78387", "dateReserved": "2026-08-24T14:04:08.566Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20107](https://vulnerability.circl.lu/vuln/gcve-1-2026-20107) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "ransomlook", "repo": "https://github.com/RansomLook/RansomLook/", "vendor": "ransomlook", "versions": [ { "lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "patch" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Fafner [_KeyZee_]" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions.

\n

As a result, API credentials could be recovered by inspecting the page source or DOM. The credentials could also be unintentionally exposed through components that retain or inspect HTTP response bodies, such as debugging proxies, browser caches, monitoring systems, or other intermediaries. An attacker obtaining one of these tokens could subsequently authenticate using the privileges assigned to that key, including access to private data where the key was granted such permissions.

\n

The patch removes API keys from subsequent page rendering and replaces them with SHA-256-derived opaque handles. Administrative actions submit only these handles, which are resolved back to the corresponding token on the server. The full API key is therefore disclosed only once, when it is initially created.


" } ], "value": "RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions.\n\n\nAs a result, API credentials could be recovered by inspecting the page source or DOM. The credentials could also be unintentionally exposed through components that retain or inspect HTTP response bodies, such as debugging proxies, browser caches, monitoring systems, or other intermediaries. An attacker obtaining one of these tokens could subsequently authenticate using the privileges assigned to that key, including access to private data where the key was granted such permissions.\n\n\nThe patch removes API keys from subsequent page rendering and replaces them with SHA-256-derived opaque handles. Administrative actions submit only these handles, which are resolved back to the corresponding token on the server. The full API key is therefore disclosed only once, when it is initially created." } ], "impacts": [ { "capecId": "CAPEC-116", "descriptions": [ { "lang": "en", "value": "CAPEC-116 Excavation" } ] }, { "capecId": "CAPEC-545", "descriptions": [ { "lang": "en", "value": "CAPEC-545 Pull Data from System Resources" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/RansomLook/RansomLook/commit/b358dfa4f40c677a47c602ebbb4473aeae349f5c" } ], "source": { "discovery": "UNKNOWN" }, "title": "RansomLook API Key Disclosure Through /admin/apikeys HTML Source", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20107", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-78555", "datePublished": "2026-08-24T19:38:00.000Z", "dateReserved": "2026-08-24T19:38:00.000Z", "dateUpdated": "2026-08-24T19:51:28.195854Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20107" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20094](https://vulnerability.circl.lu/vuln/gcve-1-2026-20094) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "repo": "https://github.com/MISP/misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.41", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "analyst", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "tool", "value": "Claude (the international export version)" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object.

For Event Reports, EventReportsController::deleteSelection relied on the global perm_add capability rather than a per-report ownership/authorization check. As a result, a contributor-level user could submit report IDs or UUIDs for reports belonging to other organisations and hard-delete them instance-wide. The fix changed the callback to call EventReport::fetchIfAuthorized($user, $itemId, 'delete') for each selected report before deletion.


For Sharing Groups, SharingGroupsController::deleteSelection relied on the global perm_sharing_group capability rather than verifying ownership of each selected sharing group. This allowed a sharing-group-capable user to hard-delete sharing groups owned by other organisations, bypassing the per-object ownership gate used by the single-object delete action. The fix changed the callback to call SharingGroup::checkIfOwner($user, $itemId) for each selected sharing group.

An authenticated attacker with the relevant broad role permission could abuse the affected bulk deletion endpoints to delete objects outside their organisation’s authorization scope, causing loss of event-report content or sharing-group configuration across the instance.



" } ], "value": "MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object.\n\nFor Event Reports, EventReportsController::deleteSelection relied on the global perm_add capability rather than a per-report ownership/authorization check. As a result, a contributor-level user could submit report IDs or UUIDs for reports belonging to other organisations and hard-delete them instance-wide. The fix changed the callback to call EventReport::fetchIfAuthorized($user, $itemId, 'delete') for each selected report before deletion.\n\n\n\n\nFor Sharing Groups, SharingGroupsController::deleteSelection relied on the global perm_sharing_group capability rather than verifying ownership of each selected sharing group. This allowed a sharing-group-capable user to hard-delete sharing groups owned by other organisations, bypassing the per-object ownership gate used by the single-object delete action. The fix changed the callback to call SharingGroup::checkIfOwner($user, $itemId) for each selected sharing group.\n\n\n\n\nAn authenticated attacker with the relevant broad role permission could abuse the affected bulk deletion endpoints to delete objects outside their organisation’s authorization scope, causing loss of event-report content or sharing-group configuration across the instance." } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/ada02fa6d7558732aa4712fd5e9451cd8c5b7a64" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/f99b3f16ef22c7acf10e17036c777759cf031c15" } ], "source": { "discovery": "INTERNAL" }, "title": "MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20094", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20094", "datePublished": "2026-06-22T11:54:10.298853Z", "dateUpdated": "2026-06-22T11:56:08.008149Z", "cveId": "CVE-2026-56423", "dateReserved": "2026-06-22T11:56:07.846Z" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-20087](https://vulnerability.circl.lu/vuln/gcve-1-2026-20087) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "repo": "https://github.com/misp/misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.41", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "analyst", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "tool", "value": "Claude (the international export version)" }, { "lang": "en", "type": "analyst", "value": "Jakub Chyliński" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid, and related nested object identifiers) without consistently stripping, pinning, or revalidating them against the server-authorized object.

In affected paths, an authenticated user with access to one authorized object could submit crafted REST or form payloads that caused MISP to save data against a different object than the one checked by the authorization logic. Depending on the endpoint, this could allow object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user’s context.

The fixes harden affected create/edit/import flows by stripping client-supplied primary keys on create-only saves, re-pinning route- or database-authorized identifiers before save operations, validating effective sharing-group scope, and adding field whitelists where ownership fields must never be editable. The initial broad fix also added a central CRUDComponent::edit() primary-key re-pin so payload-supplied IDs cannot redirect saves away from the already-authorized row. GitHub’s patch for 7acf8220c describes this central issue as CRUDComponent::edit() copying supplied fields, including a payload primary key, onto the loaded record, allowing CakePHP save() to update an arbitrary row unless the loaded ID is re-pinned.


" } ], "value": "Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (event_id, org_id, user_id, sharing_group_id, galaxy_cluster_uuid, organisation_uuid, and related nested object identifiers) without consistently stripping, pinning, or revalidating them against the server-authorized object.\n\nIn affected paths, an authenticated user with access to one authorized object could submit crafted REST or form payloads that caused MISP to save data against a different object than the one checked by the authorization logic. Depending on the endpoint, this could allow object overwrite, object re-parenting, ownership transfer, unauthorized sharing-group scoping, event/object injection, proposal retargeting, or stored attacker-controlled content appearing in another user’s context.\n\nThe fixes harden affected create/edit/import flows by stripping client-supplied primary keys on create-only saves, re-pinning route- or database-authorized identifiers before save operations, validating effective sharing-group scope, and adding field whitelists where ownership fields must never be editable. The initial broad fix also added a central CRUDComponent::edit() primary-key re-pin so payload-supplied IDs cannot redirect saves away from the already-authorized row. GitHub’s patch for 7acf8220c describes this central issue as CRUDComponent::edit() copying supplied fields, including a payload primary key, onto the loaded record, allowing CakePHP save() to update an arbitrary row unless the loaded ID is re-pinned." } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/7acf8220cafac58bcfb362da37aca512fe4bb396" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/bc182d55dde5686a36ca2eb88fe6c2adabb9fad9" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/58f637aaab4d133e72f1454ebb963191d96d3b78" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/05aad418c57bb78e6b58a843d70d45de8f50db45" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/63aebc27a878233b9475c742985aaef909bc755b" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/00b2e3dae56fa24ea750eb525cc4709b7e5bee85" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/634f1f87c295193486c08c2c7ba1fee8a7339baa" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/ab9619dfa6cb5210fd20fb3b0b57006e4fc93916" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/8311427c2edd72a8341f0a65e1f11073d7ad9191" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/c80a3533b3d787f45f5185a4621cc0f05b0cf2e5" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/025f711506850aadb69cde1b57e5e5d57628c87f" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/3ff6bd9cfdab5d41b4667ea7298d88ffd6f3fcb8" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/84bafe69f5d0ab7f811371c0801a613f271ebc0b" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/2cc26f38f3e85c594957899f09043d5193146607" }, { "tags": [ "patch" ], "url": "https://github.com/MISP/MISP/commit/57433015815e59db5a1f11536f90920952cf3fcd" }, { "url": "https://github.com/MISP/MISP/commit/9341690e9b6dde7f0605edea5533e05ba7362e35" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-20087", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-56422", "datePublished": "2026-06-22T11:38:00.000Z", "dateReserved": "2026-06-22T11:42:00.000Z", "dateUpdated": "2026-06-23T05:58:42.768204Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2026-20087" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2026-0031](https://vulnerability.circl.lu/vuln/gcve-1-2026-0031) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.37", "status": "affected", "version": "0" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Jeroen Gui" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name.

\n

An attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact.

\n

The issue was fixed by removing direct use of the user-supplied order parameter, validating requested ordering fields against allowed model fields or the model schema, and constructing the order clause using validated field names and normalized sort directions only.


" } ], "value": "A SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name.\n\n\nAn attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact.\n\n\nThe issue was fixed by removing direct use of the user-supplied order parameter, validating requested ordering fields against allowed model fields or the model schema, and constructing the order clause using validated field names and normalized sort directions only." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "pat" ], "url": "https://github.com/MISP/MISP/commit/53fc6be7da1c010ca4696a37c6e27bb699377efa" } ], "source": { "discovery": "UNKNOWN" }, "title": "MISP - SQL injection via unvalidated ordering parameters in event and shadow attribute listings", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2026-0031", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2026-44381", "datePublished": "2026-04-29T20:14:00.000Z", "dateUpdated": "2026-05-06T16:00:13.755114Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2026-0031", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2026-04-29T20:14:47.117221Z" ], [ "alexandre.dulaunoy@circl.lu", "2026-05-06T16:00:13.755114Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0027](https://vulnerability.circl.lu/vuln/gcve-1-2025-0027) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A reflected cross-site scripting (XSS) vulnerability was discovered in the server edit functionality of MISP. In serverRuleElements/pull.ctp and serverRuleElements/push.ctp, the id (server ID) value was written directly into an inline JavaScript variable (var serverID = \"…\"), without HTML escaping. A remote attacker could craft a URL with a malicious id value that, when visited by an authenticated user with access to the server edit interface, would result in arbitrary JavaScript execution in the victim’s browser.
" } ], "value": "A reflected cross-site scripting (XSS) vulnerability was discovered in the server edit functionality of MISP. In serverRuleElements/pull.ctp and serverRuleElements/push.ctp, the id (server ID) value was written directly into an inline JavaScript variable (var serverID = \"…\"), without HTML escaping. A remote attacker could craft a URL with a malicious id value that, when visited by an authenticated user with access to the server edit interface, would result in arbitrary JavaScript execution in the victim’s browser." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/b24e37a6c78199a4c68bb3b95f53d37962973d86" } ], "source": { "discovery": "UNKNOWN" }, "title": "Reflected cross-site scripting (XSS) vulnerability in the server edit functionality of MISP", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0027", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-27T07:17:00.000Z", "dateUpdated": "2025-12-02T08:51:04.323899Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0027", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-27T07:17:57.069969Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-27T07:24:10.363842Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:51:04.323899Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0026](https://vulnerability.circl.lu/vuln/gcve-1-2025-0026) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the Server Edit interface, specifically within the JavaScript initialization code of the push and pull filtering rule elements. Prior to commit b24e37a6c78199a4c68bb3b95f53d37962973d86, the id parameter (server ID) was embedded directly into a JavaScript string without HTML escaping. A maliciously crafted id value containing JavaScript or special characters could be reflected into the page and executed when an authenticated user visited the server edit page." } ], "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the Server Edit interface, specifically within the JavaScript initialization code of the push and pull filtering rule elements. Prior to commit b24e37a6c78199a4c68bb3b95f53d37962973d86, the id parameter (server ID) was embedded directly into a JavaScript string without HTML escaping. A maliciously crafted id value containing JavaScript or special characters could be reflected into the page and executed when an authenticated user visited the server edit page." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/b24e37a6c78199a4c68bb3b95f53d37962973d86" } ], "source": { "discovery": "UNKNOWN" }, "title": "Reflected cross-site scripting (XSS) vulnerability in the Server Edit interface,", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0026", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:35:00.000Z", "dateUpdated": "2025-12-02T08:50:46.381572Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0026", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:35:06.666237Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:50:46.381572Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0025](https://vulnerability.circl.lu/vuln/gcve-1-2025-0025) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the Attribute Replacement Tool. Prior to commit f20e93e289998290946d56273528d2a4dc1c57fc, the event_id parameter was inserted into both the form action URL and an inline JavaScript handler without proper HTML-escaping. A malicious actor could craft a link with a specially crafted event_id value containing JavaScript, which would then be reflected back to the user and executed when the page was rendered." } ], "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the Attribute Replacement Tool. Prior to commit f20e93e289998290946d56273528d2a4dc1c57fc, the event_id parameter was inserted into both the form action URL and an inline JavaScript handler without proper HTML-escaping. A malicious actor could craft a link with a specially crafted event_id value containing JavaScript, which would then be reflected back to the user and executed when the page was rendered." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/f20e93e289998290946d56273528d2a4dc1c57fc" } ], "source": { "discovery": "UNKNOWN" }, "title": "Reflected cross-site scripting (XSS) vulnerability in the MISP Attribute Replacement Tool", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0025", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:27:00.000Z", "dateUpdated": "2025-12-02T08:50:18.897756Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0025", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:27:43.742150Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:29:13.941057Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:50:18.897756Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0024](https://vulnerability.circl.lu/vuln/gcve-1-2025-0024) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the showAttributeTag / tag selection UI." } ], "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the showAttributeTag / tag selection UI." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/cbfcf1cdd2797de8f3da439f217bb8b9f0cd8cef" } ], "source": { "discovery": "UNKNOWN" }, "title": "cross-site scripting (XSS) vulnerability in the MISP showAttributeTag", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0024", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:14:00.000Z", "dateUpdated": "2025-12-02T08:50:01.482327Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0024", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:14:57.013842Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:15:27.131244Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:50:01.482327Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0023](https://vulnerability.circl.lu/vuln/gcve-1-2025-0023) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained a cross-site scripting (XSS) vulnerability in the Server Comparison tool. Prior to commit 83cc0b50971798bbf4be674e9ba744a8e874233a, certain fields displayed in the comparison view were not properly sanitized before being inserted into the HTML output. A malicious or compromised site-admin could inject crafted HTML/JavaScript payloads into comparison content, which would then execute in the browser of another site-admin viewing the Server Comparison interface." } ], "value": "MISP contained a cross-site scripting (XSS) vulnerability in the Server Comparison tool. Prior to commit 83cc0b50971798bbf4be674e9ba744a8e874233a, certain fields displayed in the comparison view were not properly sanitized before being inserted into the HTML output. A malicious or compromised site-admin could inject crafted HTML/JavaScript payloads into comparison content, which would then execute in the browser of another site-admin viewing the Server Comparison interface." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/83cc0b50971798bbf4be674e9ba744a8e874233a" } ], "source": { "discovery": "UNKNOWN" }, "title": "XSS in MISP server comparison tool", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0023", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:10:00.000Z", "dateUpdated": "2025-12-02T08:49:24.626168Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0023", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:10:30.111214Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:49:24.626168Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0022](https://vulnerability.circl.lu/vuln/gcve-1-2025-0022) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "download_attachments_on_load is set to true by default, but setting this to false introduces a potential security risk. Clarified this in the setting" } ], "value": "download_attachments_on_load is set to true by default, but setting this to false introduces a potential security risk. Clarified this in the setting" } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/5410685896b89aed11ace870b9c22c17752d1807" } ], "source": { "discovery": "UNKNOWN" }, "title": "Clarified setting's impact on download_attachments_on_load", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0022", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:04:00.000Z", "dateUpdated": "2025-12-02T08:49:04.510294Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0022", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:04:54.084661Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:49:04.510294Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0021](https://vulnerability.circl.lu/vuln/gcve-1-2025-0021) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In MISP, the “REST client” interface that allows viewing data returned by modules suffered from a cross-site scripting (XSS) vulnerability when presenting “HTML view” of arbitrary JSON data. Prior to commit d718c026d5d69a50e3bbd51847a05ad8f386ec6c, the application did not sufficiently validate or restrict the type of response before offering to render it as HTML, allowing malicious JSON responses to be rendered in HTML context. This could allow an attacker (via a compromised or malicious module) to supply JSON containing content that, when interpreted as HTML, executes as script in the user’s browser." } ], "value": "In MISP, the “REST client” interface that allows viewing data returned by modules suffered from a cross-site scripting (XSS) vulnerability when presenting “HTML view” of arbitrary JSON data. Prior to commit d718c026d5d69a50e3bbd51847a05ad8f386ec6c, the application did not sufficiently validate or restrict the type of response before offering to render it as HTML, allowing malicious JSON responses to be rendered in HTML context. This could allow an attacker (via a compromised or malicious module) to supply JSON containing content that, when interpreted as HTML, executes as script in the user’s browser." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/d718c026d5d69a50e3bbd51847a05ad8f386ec6c" } ], "source": { "discovery": "UNKNOWN" }, "title": "XSS in MISP ReST client in HTML view", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0021", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T15:55:00.000Z", "dateUpdated": "2025-12-02T08:48:41.869838Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0021", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T15:55:16.468388Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:48:41.869838Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0020](https://vulnerability.circl.lu/vuln/gcve-1-2025-0020) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
The “Galaxy element JSON view\", a functionality that renders JSON representations of “galaxy elements”, contained a cross-site scripting (XSS) vulnerability. 

The issue could allow a malicious user (with the ability to influence galaxy element data) to inject JavaScript payloads that would execute in the browser of another user viewing the JSON view. 
" } ], "value": "The “Galaxy element JSON view\", a functionality that renders JSON representations of “galaxy elements”, contained a cross-site scripting (XSS) vulnerability. \n\n\n\n\nThe issue could allow a malicious user (with the ability to influence galaxy element data) to inject JavaScript payloads that would execute in the browser of another user viewing the JSON view." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/aa882b23425dd4ef45d0a5f33ff0b5eed36ec9a4" } ], "source": { "discovery": "UNKNOWN" }, "title": "cross-site scripting (XSS) in Galaxy element JSON view", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0020", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T15:49:00.000Z", "dateUpdated": "2025-12-02T08:47:41.151429Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0020", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T15:49:06.903712Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:47:41.151429Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0018](https://vulnerability.circl.lu/vuln/gcve-1-2025-0018) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "lookyloo", "vendor": "lookyloo", "versions": [ { "lessThanOrEqual": "1.35.0", "status": "affected" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A HTML injection issue was identified in Lookyloo’s web interface helper function shorten_string (website/web/__init__.py). The function was used to truncate and render user-controlled values inside HTML (for example in a <span title=\"...\"> attribute) without first escaping the string. This allowed crafted input containing HTML to be injected into the rendered page.

On a standard Lookyloo installation, the configured Content Security Policy (CSP) significantly limited the impact and prevented direct script execution in most scenarios, but the underlying HTML injection bug was still present and could become exploitable if CSP was relaxed or modified.

" } ], "value": "A HTML injection issue was identified in Lookyloo’s web interface helper function shorten_string (website/web/__init__.py). The function was used to truncate and render user-controlled values inside HTML (for example in a  attribute) without first escaping the string. This allowed crafted input containing HTML to be injected into the rendered page.\n\nOn a standard Lookyloo installation, the configured Content Security Policy (CSP) significantly limited the impact and prevented direct script execution in most scenarios, but the underlying HTML injection bug was still present and could become exploitable if CSP was relaxed or modified." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/Lookyloo/lookyloo/commit/ac2f73dbfcad88b815b18c42cca77a1c645f1726" }, { "tags": [ "vendor-advisory" ], "url": "https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-m9g6-23c8-vrxf" } ], "source": { "discovery": "UNKNOWN" }, "title": "HTML injection issue was identified in Lookyloo’s web interface helper function", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "If you don't upgrade, a proper CSP policy will avoid this vulnerability." } ], "value": "If you don't upgrade, a proper CSP policy will avoid this vulnerability." } ], "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0018", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2025-65095", "datePublished": "2025-11-18T15:33:00.000Z", "dateUpdated": "2025-11-18T20:39:45.579295Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0018", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-18T15:33:07.767301Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-18T15:49:02.564916Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-18T20:39:45.579295Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0017](https://vulnerability.circl.lu/vuln/gcve-1-2025-0017) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "cerebrate", "vendor": "cerebrate", "versions": [ { "lessThan": "1.30", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "ENISA" }, { "lang": "en", "type": "remediation developer", "value": "Sami Mokaddem" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Privilege escalation in UsersController::edit in Cerebrate Project (until version v1.29) allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id/organisation_id fields in the edit request." } ], "value": "Privilege escalation in UsersController::edit in Cerebrate Project (until version v1.29) allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id/organisation_id fields in the edit request." } ], "exploits": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html" } ] } ], "impacts": [ { "capecId": "CAPEC-233", "descriptions": [ { "lang": "en", "value": "CAPEC-233 Privilege Escalation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/cerebrate-project/cerebrate/commit/c9bfa90abc85d4a20a9cc2f282959b72bef829bb" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html" } ] } ], "source": { "discovery": "UNKNOWN" }, "title": "Privilege escalation in Cerebrate allows an authenticated non-privileged user to escalate their privileges", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0017", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2025-66385", "datePublished": "2025-11-12T08:15:00.000Z", "dateUpdated": "2025-11-28T07:22:08.205835Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0017", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-12T08:15:46.336994Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-28T07:20:30.439115Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-28T07:22:08.205835Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0014](https://vulnerability.circl.lu/vuln/gcve-1-2025-0014) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "status": "affected", "version": "2.5.24" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Cross-site scripting in Mermaid chart rendering component in MISP event report allows a remote attacker part of a MISP community to execute arbitrary JavaScript in the victim’s browser via injection of HTML tags in raw Mermaid charts synchronized through event reports." } ], "value": "Cross-site scripting in Mermaid chart rendering component in MISP event report allows a remote attacker part of a MISP community to execute arbitrary JavaScript in the victim’s browser via injection of HTML tags in raw Mermaid charts synchronized through event reports." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/bb909aff9503c8c8d4bfe6de94f54d7c90dce8ac" } ], "source": { "discovery": "UNKNOWN" }, "title": "XSS in event report via Mermaid diagram", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0014", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0014", "datePublished": "2025-11-04T08:58:00.024516Z", "dateUpdated": "2025-11-04T08:58:00.024516Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T08:58:00.024516Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0013](https://vulnerability.circl.lu/vuln/gcve-1-2025-0013) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.24", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy from NATO Cyber Security Center" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Authorization bypass / improper access control in app/Controller/SharingGroupBlueprintsController.php in MISP on web application /or API allows an authenticated low-privilege user to inject arbitrary organizations into existing sharing groups (including groups that should not be extendable), thereby granting those organizations access to shared resources and escalating access via crafted sharing-group blueprints or API requests that bypass validation." } ], "value": "Authorization bypass / improper access control in app/Controller/SharingGroupBlueprintsController.php in MISP on web application /or API allows an authenticated low-privilege user to inject arbitrary organizations into existing sharing groups (including groups that should not be extendable), thereby granting those organizations access to shared resources and escalating access via crafted sharing-group blueprints or API requests that bypass validation." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/d6cc16e8cacb70d23515a85e0e81c95c096d9dd0" } ], "source": { "discovery": "UNKNOWN" }, "title": "Vulnerability in sharing group blueprints allowing sharing group injection", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0013", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0013", "datePublished": "2025-11-04T08:49:21.558087Z", "dateUpdated": "2025-11-04T08:49:21.558087Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T08:49:21.558087Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0011](https://vulnerability.circl.lu/vuln/gcve-1-2025-0011) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.24", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Raphael Lob from NATO Cyber Security Center" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Invalid check for uploaded file validity in EventsController can lead to arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request" } ], "value": "Invalid check for uploaded file validity in EventsController can lead to arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request" } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/6867f0d3157a1959154bdad9ddac009dec6a19f5" } ], "source": { "discovery": "UNKNOWN" }, "title": "Arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0011", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0011", "datePublished": "2025-11-04T07:01:25.464225Z", "dateUpdated": "2025-11-04T07:01:25.464225Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T07:01:25.464225Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ```