CWE-94

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:cairo-dock:glx-dock:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "href Attribute Handler"
          ],
          "product": "Glx-Dock",
          "vendor": "Cairo-dock",
          "versions": [
            {
              "status": "affected",
              "version": "3.4.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Havook (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T02:15:23.708Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-436454 | Cairo-dock Glx-Dock href Attribute bg_forum.php cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/436454"
        },
        {
          "name": "VDB-436454 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/436454/cti"
        },
        {
          "name": "CVE-2026-127285 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-127285"
        },
        {
          "name": "Submit #1042362 | Cairo-dock Glx-Dock  3.4.0 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1042362"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-12T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-12T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-12T18:50:01.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Cairo-dock Glx-Dock href Attribute bg_forum.php cross site scripting",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-127285",
    "datePublished": "2026-11-13T02:15:23.708Z",
    "dateReserved": "2026-11-12T17:44:50.117Z",
    "dateUpdated": "2026-11-13T02:15:23.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"
          ],
          "product": "Smart Attendance System with QR Code Scanner",
          "vendor": "SourceCodester",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yuechuya (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality of the file reset_password.php. This manipulation of the argument Username causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T01:30:27.919Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-436448 | SourceCodester Smart Attendance System with QR Code Scanner reset_password.php cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/436448"
        },
        {
          "name": "VDB-436448 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/436448/cti"
        },
        {
          "name": "CVE-2026-127282 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-127282"
        },
        {
          "name": "Submit #1041018 | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1041018"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-07-Reflected-XSS-ResetPassword.md"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.sourcecodester.com/"
        }
      ],
      "tags": [
        "x_freeware"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-12T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-12T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-12T18:43:55.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "SourceCodester Smart Attendance System with QR Code Scanner reset_password.php cross site scripting",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-127282",
    "datePublished": "2026-11-13T01:30:27.919Z",
    "dateReserved": "2026-11-12T17:38:41.488Z",
    "dateUpdated": "2026-11-13T01:30:27.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/datamodel-code-generator",
          "product": "datamodel-code-generator",
          "repo": "https://github.com/datamodel-code-generator/datamodel-code-generator",
          "vendor": "datamodel-code-generator",
          "versions": [
            {
              "lessThan": "0.84.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Enrik Mustafa"
        }
      ],
      "datePublic": "2026-09-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse_python_type_annotation and _python_type_expr_from_ast. Attackers can embed malicious Python expressions such as __import__ calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model_rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T20:58:59.634Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.84.0"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/datamodel-code-generator/datamodel-code-generator/commit/ebfc11d0644d37a71374b28aac06d98748e584ec"
        },
        {
          "name": "VulnCheck Advisory: datamodel-code-generator \u003c 0.84.0 Code Injection via x-python-type Annotation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-x-python-type-annotation"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "datamodel-code-generator \u003c 0.84.0 Code Injection via x-python-type Annotation",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127208",
    "datePublished": "2026-11-12T20:58:59.634Z",
    "dateReserved": "2026-11-12T16:30:10.903Z",
    "dateUpdated": "2026-11-12T20:58:59.634Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127120",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T00:26:58.368939Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T00:27:15.978Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:governikus:ausweisapp_mobile:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "StartPAOSResponse Handler"
          ],
          "product": "AusweisApp Mobile",
          "vendor": "Governikus",
          "versions": [
            {
              "status": "affected",
              "version": "2.5.0"
            },
            {
              "status": "affected",
              "version": "2.5.1"
            },
            {
              "status": "affected",
              "version": "2.5.2"
            },
            {
              "status": "affected",
              "version": "2.5.3"
            },
            {
              "status": "affected",
              "version": "2.5.4"
            },
            {
              "status": "affected",
              "version": "2.5.5"
            },
            {
              "status": "unaffected",
              "version": "2.6.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "governikus (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be initiated remotely. Upgrading to version 2.6.0 will fix this issue. Upgrading the affected component is advised. This CVE was requested by the vendor."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T20:00:18.060Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-436402 | Governikus AusweisApp Mobile StartPAOSResponse cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/436402"
        },
        {
          "name": "VDB-436402 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/436402/cti"
        },
        {
          "name": "CVE-2026-127120 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-127120"
        },
        {
          "name": "Submit #1033285 | Governikus Software GmbH AusweisApp 2.5.4 Cross Site Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1033285"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.Governikus.de/loesungen/kundenprojekte/AusweisApp/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-12T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-12T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-12T16:31:27.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Governikus AusweisApp Mobile StartPAOSResponse cross site scripting",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-127120",
    "datePublished": "2026-11-12T20:00:18.060Z",
    "dateReserved": "2026-11-12T15:25:35.157Z",
    "dateUpdated": "2026-11-13T00:27:15.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "misp_modules/modules/expansion/wiki.py"
          ],
          "product": "misp-modules",
          "programFiles": [
            "misp_modules/modules/expansion/wiki.py"
          ],
          "repo": "https://github.com/MISP/misp-modules",
          "vendor": "misp",
          "versions": [
            {
              "lessThanOrEqual": "3.1.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.1.4",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Alexandre Dulaunoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: \u0027SELECT ?item WHERE { ?item rdfs:label\"\u0027 + request.get(\"text\") + \u0027\" @en }\u0027. An authenticated MISP user with access to the module could supply a crafted text attribute value containing SPARQL syntax (quotes, closing braces, UNION, SERVICE, LIMIT, etc.) to alter the structure of the query sent to the Wikidata SPARQL endpoint. This could allow an attacker to modify the query logic, extract unintended data, or cause the query to fail in ways that expose internal error details. Additionally, the old error handling path formatted raw exception objects into the response string (\u0027wikidata API not accessible {}\u0027.format(e)), potentially leaking internal information such as proxy credentials, query contents, or response bodies. The module also used a spoofed browser user-agent string and the deprecated Wikidata endpoint. The vulnerability required authenticated access to the MISP instance and the ability to invoke the wiki expansion module with a text attribute. The impact is limited to manipulation of the enrichment query and potential disclosure of internal error details; it does not directly compromise the MISP server or its stored data."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-143",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-143 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-11-12T05:54:11Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T07:33:51.485Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9"
        },
        {
          "url": "https://misp.github.io/misp-modules/expansion/#wikidata-lookup"
        },
        {
          "url": "https://github.com/MISP/misp-modules/pull/869"
        },
        {
          "url": "https://github.com/MISP/misp-modules"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is remediated by properly escaping user-supplied text as a SPARQL string literal using json.dumps with ensure_ascii=False, which neutralizes quotes, backslashes, newlines, and control characters. Additional hardening includes strict validation of the language tag, numeric configuration values, text length, and UUID format before query construction; validation of Wikidata response structure and entity URI format before importing results; replacement of raw exception formatting with generic error messages that do not expose upstream details; use of the modern Wikidata SPARQL endpoint with POST method; a proper MISP user-agent string; and a bounded request timeout."
        }
      ],
      "title": "SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "partial",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The CAPEC-143 mapping is the closest available pattern; no SPARQL-specific CAPEC exists in the catalog. The underlying technique (query injection via unsanitized string concatenation) is identical to SQL injection.",
                  "CVSS PR:L assumes the attacker has authenticated access to a MISP instance with the wiki expansion module enabled. The actual privilege level required depends on MISP role configuration, which is not specified in the patch.",
                  "The affected version range is unspecified; the patch does not include version tags or release boundaries. The vulnerability existed in module version 0.2 (as indicated by the old moduleinfo) and was fixed in version 1.0.",
                  "The CVSS VI:L rating accounts for both the query manipulation and the old error-message information disclosure. If only the injection is considered (without the error leak), VI could be rated N.",
                  "The patch is treated as a single vulnerability fix (SPARQL injection) with associated hardening changes (error sanitization, input validation, endpoint update). The caller asserts all changes relate to the same vulnerability.",
                  "No evidence of active exploitation, PoC, or in-the-wild usage was found in the patch or metadata."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-143",
                    "rationale": "CAPEC-143 describes injection of query language fragments through unsanitized input into a dynamically constructed query. Although the CAPEC name references SQL specifically, the attack pattern is identical: an attacker supplies input containing query-language metacharacters (quotes, braces, keywords) that alter the structure of the query sent to an interpreter. SPARQL injection follows the same pattern. This is the closest available CAPEC; no SPARQL-specific CAPEC exists in the catalog. The uncertainty is that the CAPEC is SQL-specific in naming, but the underlying technique (query injection via string concatenation) is the same."
                  }
                ],
                "commit": "7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Alexandre Dulaunoy"
                  }
                ],
                "cvssRationale": "AV:N: The module is invoked over the network via the MISP API. AC:L: The injection requires only crafting a text value with SPARQL metacharacters; no race conditions or complex prerequisites. AT:N: No need to manipulate the attack target. PR:L: Requires authenticated access to a MISP instance with the wiki module enabled. UI:N: No user interaction beyond the API call. VC:N: The queried data is public Wikidata; no confidential MISP data is exposed. VI:L: An attacker can alter the enrichment results (integrity of advisory annotations) and the old error path could leak internal details. VA:N: No meaningful availability impact on the MISP system. SC/SI/SA:N: No impact on external systems beyond the public Wikidata service. Overall severity is low given the limited blast radius.",
                "draft": false,
                "fixSummary": "The vulnerability is remediated by properly escaping user-supplied text as a SPARQL string literal using json.dumps with ensure_ascii=False, which neutralizes quotes, backslashes, newlines, and control characters. Additional hardening includes strict validation of the language tag, numeric configuration values, text length, and UUID format before query construction; validation of Wikidata response structure and entity URI format before importing results; replacement of raw exception formatting with generic error messages that do not expose upstream details; use of the modern Wikidata SPARQL endpoint with POST method; a proper MISP user-agent string; and a bounded request timeout.",
                "generatedAt": "2026-11-12T05:54:11.233388Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "potentialErrors": [],
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 6
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "5b0d882d17baea052254770c3c94d50c8e1ab2314fa4eec89088c15e059f2837",
                "patchSummary": "The patch rewrites the wiki.py handler to: (1) escape user text via json.dumps(text, ensure_ascii=False) before embedding in the SPARQL query; (2) validate language tags with a regex, numeric settings (max_results 1-25, timeout 1-60), text length (1-2000 chars), and UUID format; (3) switch from string concatenation to a properly escaped SPARQL literal; (4) use the modern https://query.wikidata.org/sparql endpoint with POST method and a MISP user-agent; (5) validate Wikidata response bindings and entity URIs against a strict pattern before creating annotation objects; (6) replace the mutable shared misperrors dict and raw exception formatting with a ModuleError class and generic error strings; (7) add a 313-line test suite (tests/test_wiki.py) covering injection vectors, invalid inputs, malformed responses, and error sanitization; (8) update documentation and module metadata to reflect the new misp_standard output format and configuration options.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9",
                    "date": "Thu, 12 Nov 2026 04:47:41 +0000",
                    "patchSha256": "5b0d882d17baea052254770c3c94d50c8e1ab2314fa4eec89088c15e059f2837",
                    "retrievedAt": "2026-11-12T05:53:20.752027Z",
                    "source": "https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9.patch",
                    "sourceUrl": "https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9.patch",
                    "subject": "Improve Wikidata enrichment and return MISP standard"
                  }
                ],
                "source": "https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-11-12T05:54:11Z",
                  "version": "2.0.3"
                },
                "subject": "Improve Wikidata enrichment and return MISP standard",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-94",
                    "rationale": "The module dynamically constructs a SPARQL query by concatenating untrusted user input directly into the query string without neutralizing special elements. This is the same pattern as code/query injection: the intended query structure is modified by attacker-controlled input. SPARQL is a query language interpreted by the Wikidata endpoint, making this a code injection into a query interpreter."
                  },
                  {
                    "cweId": "CWE-209",
                    "rationale": "The old code formatted raw exception objects into the error response string (\u0027wikidata API not accessible {}\u0027.format(e)), which could expose internal details such as proxy credentials, full query text, or upstream response bodies. The fix replaces this with generic error messages."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9): Improve Wikidata enrichment and return MISP standard",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9.patch"
                    ],
                    "timestamp": "2026-11-12T04:47:41Z",
                    "type": "fix-developed"
                  },
                  {
                    "description": "Patch retrieved from the supplied URL; retrieval time is used as the default availability time.",
                    "id": "evt-fix-available-1",
                    "references": [
                      "https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9.patch"
                    ],
                    "timestamp": "2026-11-12T05:53:20.752027Z",
                    "type": "fix-available"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20333"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-126991",
    "datePublished": "2026-11-12T07:33:51.485Z",
    "dateReserved": "2026-11-12T07:30:41.366Z",
    "dateUpdated": "2026-11-12T07:33:51.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.npmjs.com",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40tinacms/mdx",
          "product": "@tinacms/mdx",
          "repo": "https://github.com/tinacms/tinacms",
          "vendor": "tinacms",
          "versions": [
            {
              "lessThan": "2.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.4.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-11-03T02:45:45.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors\u0027 browsers or on build and server-side rendering hosts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T18:41:07.073Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6vw5-w22x-ghxv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-6vw5-w22x-ghxv"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/tinacms/tinacms/pull/7958"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/tinacms/tinacms/commit/19285c6deeee52c380e8b2fdeafedc9530dc0618"
        },
        {
          "name": "@tinacms/mdx %40tinacms Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/tinacms/tinacms/releases/tag/%40tinacms/mdx%402.4.2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/tinacms/tinacms/blob/%40tinacms/mdx%400.60.3/packages/%40tinacms/mdx/src/stringify/acorn.ts#L81"
        },
        {
          "name": "VulnCheck Advisory: @tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/tinacms-mdx-before-2.4.2-code-injection-via-mdx-serializer-rich-text-values"
        }
      ],
      "title": "@tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-126774",
    "datePublished": "2026-11-11T18:41:07.073Z",
    "dateReserved": "2026-11-11T18:27:27.097Z",
    "dateUpdated": "2026-11-11T18:41:07.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-12T05:05:03.042Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/12/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Data::Dump::Streamer"
          ],
          "packageName": "Data-Dump-Streamer",
          "packageURL": "pkg:cpan/Data-Dump-Streamer",
          "programFiles": [
            "lib/Data/Dump/Streamer.pm"
          ],
          "programRoutines": [
            {
              "name": "Data::Dump::Streamer::_dump_qr"
            }
          ],
          "repo": "https://github.com/demerphq/Data-Dump-Streamer",
          "versions": [
            {
              "lessThan": "3.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr.\n\nA Regexp\u0027s pattern is written into a qr literal without escaping \"$\" or \"@\", so \"@{[ ... ]}\" and \"${\\ ... }\" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early.\n\nAn attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T00:44:34.065Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/YVES/Data-Dump-Streamer-3.00/source/Changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Data-Dump-Streamer 3.00 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr",
      "workarounds": [
        {
          "lang": "en",
          "value": "For deployments that cannot upgrade to 3.00, which requires Perl 5.18 and a C compiler, do not restore dumps that contain Regexps compiled from untrusted input."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-126673",
    "datePublished": "2026-11-12T00:44:34.065Z",
    "dateReserved": "2026-11-11T12:57:30.656Z",
    "dateUpdated": "2026-11-12T05:05:03.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126185",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T05:00:57.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiManager",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAnalyzer",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiManager Cloud",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAnalyzer Cloud",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A improper control of generation of code (\u0027code injection\u0027) vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T21:30:50.443Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-230",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-230"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-126185",
    "datePublished": "2026-11-11T21:30:50.443Z",
    "dateReserved": "2026-11-10T20:07:44.597Z",
    "dateUpdated": "2026-11-13T05:00:57.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-126182",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T05:01:11.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiManager",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.12",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiManager Cloud",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.7",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.12",
              "status": "affected",
              "version": "7.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A improper control of generation of code (\u0027code injection\u0027) vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Execute unauthorized code or commands",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T21:30:30.930Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-227",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-227"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-126182",
    "datePublished": "2026-11-11T21:30:30.930Z",
    "dateReserved": "2026-11-10T20:07:32.844Z",
    "dateUpdated": "2026-11-13T05:01:11.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125637",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T15:58:56.046930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T15:59:14.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569294"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/konflux-ci/konflux-ci",
          "defaultStatus": "unaffected",
          "packageName": "konflux-ci",
          "versions": [
            {
              "lessThanOrEqual": "0.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank abhi04anon - (GitHub) for reporting this issue."
        }
      ],
      "datePublic": "2026-11-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. In addition, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T22:35:12.202Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-125637"
        },
        {
          "name": "RHBZ#2569294",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2569294"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-10T04:55:44.490Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-11-10T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Konflux-ci: unvalidated hostname fields enable caddyfile config injection in the konflux ui proxy generator, allowing an unauthenticated route to be spliced ahead of the forward_auth/impersonate authorization chain",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-94: Improper Control of Generation of Code"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-125637",
    "datePublished": "2026-11-11T22:35:12.202Z",
    "dateReserved": "2026-11-10T04:57:41.730Z",
    "dateUpdated": "2026-11-12T15:59:14.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}