{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T17:12:10.763639Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T17:12:36.380Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vulnerability-lookup",
          "repo": "https://github.com/vulnerability-lookup/vulnerability-lookup",
          "vendor": "vulnerability-lookup",
          "versions": [
            {
              "lessThanOrEqual": "5.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "openai/gpt-5.5-cyber-preview (reasoning level: high)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "EUVD @ ENISA Team"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Cedric Bonhomme"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Alexandre Dulaunoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA stored cross-site scripting (XSS) vulnerability existed in \u003cstrong\u003eVulnerability-Lookup\u003c/strong\u003e in the \u003ccode\u003erender_tag_badges\u003c/code\u003e Jinja filter used to display reference tags associated with vulnerability records.\u003c/p\u003e\u003cp\u003eValues from \u003ccode\u003econtainers.cna.references[].tags[]\u003c/code\u003e were directly interpolated into HTML badge elements and the resulting string was wrapped in \u003ccode\u003emarkupsafe.Markup\u003c/code\u003e. Because \u003ccode\u003eMarkup\u003c/code\u003e marks the generated content as safe, Jinja\u0027s automatic HTML escaping was bypassed.\u003c/p\u003e\u003cp\u003eAn authenticated user with permissions to create or modify vulnerability records, such as a user holding the \u003ccode\u003evulnerability:create\u003c/code\u003e or \u003ccode\u003evulnerability:modify\u003c/code\u003e permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup.\u003c/p\u003e\u003cp\u003eThe malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public \u003ccode\u003e/cve/\u0026lt;id\u0026gt;\u003c/code\u003e or \u003ccode\u003e/vuln/\u0026lt;id\u0026gt;\u003c/code\u003e page, the crafted tag would be rendered as HTML in the viewer\u0027s browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application.\u003c/p\u003e\u003cp\u003eSuccessful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim\u0027s browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated.\u003c/p\u003e\u003cp\u003eThe issue was corrected by applying \u003ccode\u003emarkupsafe.escape()\u003c/code\u003e to each reference tag before inserting it into the HTML badge markup, while retaining \u003ccode\u003eMarkup\u003c/code\u003e only for the static HTML scaffolding.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records.\n\nValues from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe, Jinja\u0027s automatic HTML escaping was bypassed.\n\nAn authenticated user with permissions to create or modify vulnerability records, such as a user holding the vulnerability:create or vulnerability:modify permission, could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup.\n\nThe malicious value would subsequently be stored as part of the vulnerability record. When another user visited the corresponding public /cve/\u003cid\u003e or /vuln/\u003cid\u003e page, the crafted tag would be rendered as HTML in the viewer\u0027s browser. This could result in JavaScript execution in the security context of the Vulnerability-Lookup application.\n\nSuccessful exploitation could allow an attacker to perform actions in the context of a victim, access information available to the victim\u0027s browser session, or modify page content. As the affected vulnerability pages can be accessed publicly, exploitation may affect users who are not authenticated.\n\nThe issue was corrected by applying markupsafe.escape() to each reference tag before inserting it into the HTML badge markup, while retaining Markup only for the static HTML scaffolding."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T14:05:39.735Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/d29901655c50cf3c25737d9ea86180268df51b57"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-73374",
    "datePublished": "2026-08-12T14:05:39.735Z",
    "dateReserved": "2026-08-12T14:05:33.426Z",
    "dateUpdated": "2026-08-12T17:12:36.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73405",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T17:10:10.914574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T17:10:19.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vulnerability-lookup",
          "repo": "https://github.com/vulnerability-lookup/vulnerability-lookup",
          "vendor": "vulnerability-lookup",
          "versions": [
            {
              "lessThanOrEqual": "5.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "openai/gpt-5.5-cyber-preview (reasoning level: high)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "EUVD @ ENISA Team"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Cedric Bonhomme"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Alexandre Dulaunoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn authorization bypass vulnerability in \u003cstrong\u003eVulnerability-Lookup\u003c/strong\u003e allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the \u003ccode\u003e/pubsub/subscribe/\u0026lt;topic\u0026gt;\u003c/code\u003e endpoint.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003etoken_required\u003c/code\u003e decorator used by the Pub/Sub interface authenticated requests solely by matching the \u003ccode\u003eX-API-KEY\u003c/code\u003e header against an existing user API key. Unlike the REST API authentication mechanism, it did not verify the account\u0027s \u003ccode\u003eis_active\u003c/code\u003e and \u003ccode\u003eis_confirmed\u003c/code\u003e state.\u003c/p\u003e\n\u003cp\u003eBecause the self-registration process issues an API key before account confirmation is completed, an attacker could create an account and immediately use the resulting API key to access Pub/Sub topics that should only be available to active, confirmed users. This could expose stream events that would otherwise be inaccessible through the REST API, including newly submitted or not-yet-moderated data such as comments.\u003c/p\u003e\n\u003cp\u003eThe vulnerability results from inconsistent authorization enforcement between the REST API and the SSE streaming interface.\u003c/p\u003e\n\u003cp\u003eThe patch corrects the issue by requiring accounts to be both \u003cstrong\u003eactive\u003c/strong\u003e and \u003cstrong\u003econfirmed\u003c/strong\u003e before permitting access to Pub/Sub streams, bringing the SSE authorization boundary in line with the REST API.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/\u003ctopic\u003e endpoint.\n\n\nThe token_required decorator used by the Pub/Sub interface authenticated requests solely by matching the X-API-KEY header against an existing user API key. Unlike the REST API authentication mechanism, it did not verify the account\u0027s is_active and is_confirmed state.\n\n\nBecause the self-registration process issues an API key before account confirmation is completed, an attacker could create an account and immediately use the resulting API key to access Pub/Sub topics that should only be available to active, confirmed users. This could expose stream events that would otherwise be inaccessible through the REST API, including newly submitted or not-yet-moderated data such as comments.\n\n\nThe vulnerability results from inconsistent authorization enforcement between the REST API and the SSE streaming interface.\n\n\nThe patch corrects the issue by requiring accounts to be both active and confirmed before permitting access to Pub/Sub streams, bringing the SSE authorization boundary in line with the REST API."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T14:15:58.039Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/bef837242657acf680832be56b94428df130ed67"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-73405",
    "datePublished": "2026-08-12T14:15:58.039Z",
    "dateReserved": "2026-08-12T14:15:51.914Z",
    "dateUpdated": "2026-08-12T17:10:19.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73431",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T17:04:55.924147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T17:07:39.056Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vulnerability-lookup",
          "repo": "https://github.com/vulnerability-lookup/vulnerability-lookup",
          "vendor": "vulnerability-lookup",
          "versions": [
            {
              "lessThanOrEqual": "5.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "openai/gpt-5.5-cyber-preview (reasoning level: high)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "EUVD @ ENISA Team"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Cedric Bonhomme"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Alexandre Dulaunoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eVulnerability-Lookup contains an \nauthentication weakness in its account activation and password-recovery \nmechanism. Activation and recovery links were generated using stateless \nsigned tokens containing only the user\u0027s login. Although the token \nsignature and age were validated, the application did not track whether a\n token had already been successfully used. As a result, a captured \nactivation or password-recovery link remained valid for the entire \nconfigured \u003ccode\u003eTOKEN_VALIDITY_PERIOD\u003c/code\u003e, even after the associated password had been changed. \u003c/p\u003e\n\u003cp\u003eAn attacker who obtains a valid \nactivation or recovery token could therefore replay it multiple times \nduring its validity period to set a new password and repeatedly take \ncontrol of the affected account. In addition, tokens were not bound to a\n specific purpose, allowing the same token mechanism to be used across \nactivation and recovery workflows. The patch introduces purpose-bound \ntokens and a random nonce whose SHA-256 digest is stored with the user \naccount. The nonce is invalidated after a successful password change, \nmaking tokens single-use, while issuing a new token invalidates any \npreviously issued token.  The password-setting operation now explicitly consumes the token before committing the account change. \u003c/p\u003e\n\u003cp\u003eSuccessful exploitation requires \nthe attacker to obtain a currently valid activation or recovery link, \nbut does not require knowledge of the victim\u0027s existing password or an \nauthenticated session.\u003c/p\u003e"
            }
          ],
          "value": "Vulnerability-Lookup contains an \nauthentication weakness in its account activation and password-recovery \nmechanism. Activation and recovery links were generated using stateless \nsigned tokens containing only the user\u0027s login. Although the token \nsignature and age were validated, the application did not track whether a\n token had already been successfully used. As a result, a captured \nactivation or password-recovery link remained valid for the entire \nconfigured TOKEN_VALIDITY_PERIOD, even after the associated password had been changed. \n\n\nAn attacker who obtains a valid \nactivation or recovery token could therefore replay it multiple times \nduring its validity period to set a new password and repeatedly take \ncontrol of the affected account. In addition, tokens were not bound to a\n specific purpose, allowing the same token mechanism to be used across \nactivation and recovery workflows. The patch introduces purpose-bound \ntokens and a random nonce whose SHA-256 digest is stored with the user \naccount. The nonce is invalidated after a successful password change, \nmaking tokens single-use, while issuing a new token invalidates any \npreviously issued token.  The password-setting operation now explicitly consumes the token before committing the account change. \n\n\nSuccessful exploitation requires \nthe attacker to obtain a currently valid activation or recovery link, \nbut does not require knowledge of the victim\u0027s existing password or an \nauthenticated session."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-50",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-50 Password Recovery Exploitation"
            }
          ]
        },
        {
          "capecId": "CAPEC-60",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294 Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T14:32:56.538Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/bef837242657acf680832be56b94428df130ed67"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-73431",
    "datePublished": "2026-08-12T14:32:56.538Z",
    "dateReserved": "2026-08-12T14:32:51.876Z",
    "dateUpdated": "2026-08-12T17:07:39.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73432",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T17:02:44.957266Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T17:03:03.041Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vulnerability-lookup",
          "repo": "https://github.com/vulnerability-lookup/vulnerability-lookup",
          "vendor": "vulnerability-lookup",
          "versions": [
            {
              "lessThanOrEqual": "5.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "openai/gpt-5.5-cyber-preview (reasoning level: high)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "EUVD @ ENISA Team"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Cedric Bonhomme"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Alexandre Dulaunoy"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eVulnerability-Lookup contains a \u003cstrong\u003eserver-side request forgery (SSRF)\u003c/strong\u003e vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using \u003ccode\u003erequests.get()\u003c/code\u003e with automatic redirect handling and without enforcing network-boundary restrictions. \u003c/p\u003e\n\u003cp\u003eAn authenticated administrator with the \u003ccode\u003eadmin:access\u003c/code\u003e permission could configure a remote instance whose address points to an internal, loopback, link-local, or cloud metadata HTTP(S) service. When synchronization is performed, the Vulnerability-Lookup server would issue the request from its own network context. An attacker could also use a publicly accessible URL that redirects to an internal destination, because redirects were previously followed without revalidating the destination.\u003c/p\u003e\n\u003cp\u003eSuccessful exploitation could allow a privileged attacker to probe or interact with services that are accessible from the Vulnerability-Lookup server but not directly reachable by the attacker, including private network services or cloud instance metadata endpoints. The exact confidentiality, integrity, or availability impact depends on the services reachable from the application server.\u003c/p\u003e\n\u003cp\u003eThe patch introduces a shared outbound URL policy that restricts remote instances to HTTP(S), rejects non-public IP addresses, resolves hostnames at request time, and manually validates each redirect destination before following it.  The implementation explicitly blocks private, loopback, link-local, multicast, reserved, and unspecified addresses. \u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Vulnerability-Lookup contains a server-side request forgery (SSRF) vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using requests.get() with automatic redirect handling and without enforcing network-boundary restrictions. \n\n\nAn authenticated administrator with the admin:access permission could configure a remote instance whose address points to an internal, loopback, link-local, or cloud metadata HTTP(S) service. When synchronization is performed, the Vulnerability-Lookup server would issue the request from its own network context. An attacker could also use a publicly accessible URL that redirects to an internal destination, because redirects were previously followed without revalidating the destination.\n\n\nSuccessful exploitation could allow a privileged attacker to probe or interact with services that are accessible from the Vulnerability-Lookup server but not directly reachable by the attacker, including private network services or cloud instance metadata endpoints. The exact confidentiality, integrity, or availability impact depends on the services reachable from the application server.\n\n\nThe patch introduces a shared outbound URL policy that restricts remote instances to HTTP(S), rejects non-public IP addresses, resolves hostnames at request time, and manually validates each redirect destination before following it.  The implementation explicitly blocks private, loopback, link-local, multicast, reserved, and unspecified addresses."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T14:40:15.966Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/a3cf621c2583c45227a5b7880123ba0ffef3cc0f"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-73432",
    "datePublished": "2026-08-12T14:40:15.966Z",
    "dateReserved": "2026-08-12T14:40:10.040Z",
    "dateUpdated": "2026-08-12T17:03:03.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T17:00:38.181767Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T17:00:48.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vulnerability-lookup",
          "repo": "https://github.com/vulnerability-lookup/vulnerability-lookup",
          "vendor": "vulnerability-lookup",
          "versions": [
            {
              "lessThanOrEqual": "5.5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "tonghuaroot"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Cedric Bonhomme"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The webhook URL validator in `website/notifications/webhooks.py` uses\u003cbr\u003e`ip.is_global` to reject non-public addresses after DNS resolution. IPv6\u003cbr\u003etransition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo\u003cbr\u003e`2001:0000::/32`) are classified as globally routable by IANA, so `is_global`\u003cbr\u003ereturns `True` even when the embedded IPv4 targets a private, loopback, or\u003cbr\u003ecloud metadata destination. An attacker can register a webhook pointing at a\u003cbr\u003ehostname that resolves to a transition address to bypass the SSRF guard and\u003cbr\u003eexfiltrate vulnerability data to an internal endpoint.\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003eThe vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects\u003c/div\u003e\u003cdiv\u003eorganisation running the HEAD.\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "The webhook URL validator in `website/notifications/webhooks.py` uses\n`ip.is_global` to reject non-public addresses after DNS resolution. IPv6\ntransition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo\n`2001:0000::/32`) are classified as globally routable by IANA, so `is_global`\nreturns `True` even when the embedded IPv4 targets a private, loopback, or\ncloud metadata destination. An attacker can register a webhook pointing at a\nhostname that resolves to a transition address to bypass the SSRF guard and\nexfiltrate vulnerability data to an internal endpoint.\n\nThe vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects\n\norganisation running the HEAD."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T14:33:13.106Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/f3e0c6899c5b3823dcfd860fc6cb3edbedc9bf65"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-72761",
    "datePublished": "2026-08-10T14:33:13.106Z",
    "dateReserved": "2026-08-10T14:32:19.844Z",
    "dateUpdated": "2026-08-10T17:00:48.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-08T16:58:48.964002Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-08T20:10:21.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vulnerability-Lookup",
          "vendor": "CIRCL",
          "versions": [
            {
              "lessThan": "2.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In affected versions, vulnerability-lookup did not track or limit failed\n One-Time Password (OTP) attempts during Two-Factor Authentication (2FA)\n verification. An attacker who already knew or guessed a valid username \nand password could submit an arbitrary number of OTP codes without \ncausing the account to be locked or generating any specific alert for \nadministrators.\n\n\nThis lack of rate-limiting and lockout on OTP failures significantly \nlowers the cost of online brute-force attacks against 2FA codes and \nincreases the risk of successful account takeover, especially if OTP \nentropy is reduced (e.g. short numeric codes, user reuse, or predictable\n tokens). Additionally, administrators had no direct visibility into \naccounts experiencing repeated 2FA failures, making targeted attacks \nharder to detect and investigate.\n\n\nThe patch introduces a persistent failed_otp_attempts counter on user \naccounts, locks the user after 5 invalid OTP submissions, resets the \ncounter on successful verification, and surfaces failed 2FA attempts in \nthe admin user list. This enforces an account lockout policy for OTP \nbrute-force attempts and improves monitoring capabilities for suspicious\n 2FA activity.\u003cp\u003eThis issue affects Vulnerability-Lookup: before 2.18.0.\u003c/p\u003e"
            }
          ],
          "value": "In affected versions, vulnerability-lookup did not track or limit failed\n One-Time Password (OTP) attempts during Two-Factor Authentication (2FA)\n verification. An attacker who already knew or guessed a valid username \nand password could submit an arbitrary number of OTP codes without \ncausing the account to be locked or generating any specific alert for \nadministrators.\n\n\nThis lack of rate-limiting and lockout on OTP failures significantly \nlowers the cost of online brute-force attacks against 2FA codes and \nincreases the risk of successful account takeover, especially if OTP \nentropy is reduced (e.g. short numeric codes, user reuse, or predictable\n tokens). Additionally, administrators had no direct visibility into \naccounts experiencing repeated 2FA failures, making targeted attacks \nharder to detect and investigate.\n\n\nThe patch introduces a persistent failed_otp_attempts counter on user \naccounts, locks the user after 5 invalid OTP submissions, resets the \ncounter on successful verification, and surfaces failed 2FA attempts in \nthe admin user list. This enforces an account lockout policy for OTP \nbrute-force attempts and improves monitoring capabilities for suspicious\n 2FA activity.This issue affects Vulnerability-Lookup: before 2.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-08T12:01:05.831Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://vulnerability.circl.lu/vuln/gcve-1-2025-0033"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2025-42615",
    "datePublished": "2025-12-08T12:01:05.831Z",
    "dateReserved": "2025-04-16T12:34:02.866Z",
    "dateUpdated": "2025-12-08T20:10:21.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42616",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-08T14:46:29.136113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-08T14:46:41.970Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vulnerability-Lookup",
          "vendor": "CIRCL",
          "versions": [
            {
              "lessThan": "2.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003eSome endpoints in vulnerability-lookup that modified \napplication state (e.g. changing database entries, user data, \nconfigurations, or other privileged actions) may have been accessible \nvia HTTP GET requests without requiring a CSRF token. This flaw leaves \nthe application vulnerable to Cross-Site Request Forgery (CSRF) attacks:\n an attacker who tricks a logged-in user into visiting a malicious \nwebsite could cause the user\u2019s browser to issue GET requests that \nperform unintended state-changing operations in the context of their \nauthenticated session.\n\n\nBecause the server would treat these GET requests as valid (since no \nCSRF protection or POST method enforcement was in place), the attacker \ncould exploit this to escalate privileges, change settings, or carry out\n other unauthorized actions without needing the user\u2019s explicit consent \nor awareness.\u0026nbsp;\u003cbr\u003eThe fix ensures that all state-changing endpoints now require HTTP POST \nrequests and include a valid CSRF token. This enforces that state \nchanges cannot be triggered by arbitrary cross-site GET requests.\u0026nbsp;This issue affects Vulnerability-Lookup: before 2.18.0.\u003c/div\u003e"
            }
          ],
          "value": "Some endpoints in vulnerability-lookup that modified \napplication state (e.g. changing database entries, user data, \nconfigurations, or other privileged actions) may have been accessible \nvia HTTP GET requests without requiring a CSRF token. This flaw leaves \nthe application vulnerable to Cross-Site Request Forgery (CSRF) attacks:\n an attacker who tricks a logged-in user into visiting a malicious \nwebsite could cause the user\u2019s browser to issue GET requests that \nperform unintended state-changing operations in the context of their \nauthenticated session.\n\n\nBecause the server would treat these GET requests as valid (since no \nCSRF protection or POST method enforcement was in place), the attacker \ncould exploit this to escalate privileges, change settings, or carry out\n other unauthorized actions without needing the user\u2019s explicit consent \nor awareness.\u00a0\nThe fix ensures that all state-changing endpoints now require HTTP POST \nrequests and include a valid CSRF token. This enforces that state \nchanges cannot be triggered by arbitrary cross-site GET requests.\u00a0This issue affects Vulnerability-Lookup: before 2.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-08T12:58:58.408Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://vulnerability.circl.lu/vuln/gcve-1-2025-0034"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CSRF vulnerability in CIRCL Vulnerability-Lookup",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2025-42616",
    "datePublished": "2025-12-08T12:09:22.893Z",
    "dateReserved": "2025-04-16T12:34:02.866Z",
    "dateUpdated": "2025-12-08T14:46:41.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42620",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-08T12:27:00.493206Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-08T12:27:15.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vulnerability-Lookup",
          "vendor": "CIRCL",
          "versions": [
            {
              "lessThan": "2.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\n\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\nIn affected versions, vulnerability-lookup handled user-controlled \ncontent in comments and bundles in an unsafe way, which could lead to \nstored Cross-Site Scripting (XSS).\n\n\n\n\nOn the backend, the related_vulnerabilities field of bundles accepted \narbitrary strings without format validation or proper sanitization. On \nthe frontend, comment and bundle descriptions were converted from \nMarkdown to HTML and then injected directly into the DOM using string \ntemplates and innerHTML. This combination allowed an attacker who could \ncreate or edit comments or bundles to store crafted HTML/JavaScript \npayloads which would later be rendered and executed in the browser of \nany user visiting the affected profile page (user.html).\u0026nbsp;\u003c/div\u003e\n\n\u003c/div\u003e\n\n\u003cp\u003eThis issue affects Vulnerability-Lookup: before 2.18.0.\u003c/p\u003e"
            }
          ],
          "value": "In affected versions, vulnerability-lookup handled user-controlled \ncontent in comments and bundles in an unsafe way, which could lead to \nstored Cross-Site Scripting (XSS).\n\n\n\n\nOn the backend, the related_vulnerabilities field of bundles accepted \narbitrary strings without format validation or proper sanitization. On \nthe frontend, comment and bundle descriptions were converted from \nMarkdown to HTML and then injected directly into the DOM using string \ntemplates and innerHTML. This combination allowed an attacker who could \ncreate or edit comments or bundles to store crafted HTML/JavaScript \npayloads which would later be rendered and executed in the browser of \nany user visiting the affected profile page (user.html).\u00a0\n\n\n\n\n\n\n\nThis issue affects Vulnerability-Lookup: before 2.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-08T12:15:15.950Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://vulnerability.circl.lu/vuln/gcve-1-2025-0035"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CSRF vulnerability in CIRCL Vulnerability-Lookup",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2025-42620",
    "datePublished": "2025-12-08T12:15:15.950Z",
    "dateReserved": "2025-04-16T12:34:02.867Z",
    "dateUpdated": "2025-12-08T12:27:15.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-60249",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-26T17:43:48.433562Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-26T17:44:06.988Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "vulnerability-lookup",
          "vendor": "CIRCL",
          "versions": [
            {
              "status": "affected",
              "version": "2.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings. A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Bundles, Comments, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-25T17:14:03.641Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/afa12347f1461d9481eba75ac19897e80a9c7434"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-60249",
    "datePublished": "2025-09-25T00:00:00.000Z",
    "dateReserved": "2025-09-25T00:00:00.000Z",
    "dateUpdated": "2025-09-26T17:44:06.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32413",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T14:28:55.601560Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T14:52:10.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vulnerability-Lookup",
          "vendor": "CIRCL",
          "versions": [
            {
              "lessThan": "2.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T02:27:52.326Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/0a120af1de4a0a13bc2e2000f3c4639291122ba0"
        },
        {
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/compare/v2.7.0...v2.7.1"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-32413",
    "datePublished": "2025-04-08T00:00:00.000Z",
    "dateReserved": "2025-04-08T00:00:00.000Z",
    "dateUpdated": "2025-04-08T14:52:10.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}