Search criteria
14211 vulnerabilities
CVE-2026-8836 (GCVE-0-2026-8836)
Vulnerability from cvelistv5 – Published: 2026-05-18 18:45 – Updated: 2026-05-18 19:20 X_Open Source
VLAI?
Title
lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow
Summary
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue.
Severity ?
9.8 (Critical)
9.8 (Critical)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364474 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364474/cti | signaturepermissions-required |
| https://vuldb.com/submit/829798 | third-party-advisory |
| https://savannah.nongnu.org/bugs/?68194 | broken-link |
| https://cgit.git.savannah.gnu.org/cgit/lwip.git/c… | broken-linkpatch |
| https://github.com/lwip-tcpip/lwip/commit/0c957ec… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8836",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T19:19:42.938168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T19:20:22.909Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:n:lwip:*:*:*:*:*:*:*:*"
],
"modules": [
"snmpv3 USM Handler"
],
"product": "lwIP",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.2.0"
},
{
"status": "affected",
"version": "2.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0rbitingZer0 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T18:45:12.791Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364474 | lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364474"
},
{
"name": "VDB-364474 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364474/cti"
},
{
"name": "Submit #829798 | lwIP 2.1.0 Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/829798"
},
{
"tags": [
"broken-link"
],
"url": "https://savannah.nongnu.org/bugs/?68194"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://cgit.git.savannah.gnu.org/cgit/lwip.git/commit/?id=0c957ec03054eb6c8205e9c9d1d05d90ada3898c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/lwip-tcpip/lwip/commit/0c957ec03054eb6c8205e9c9d1d05d90ada3898c"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-18T16:29:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8836",
"datePublished": "2026-05-18T18:45:12.791Z",
"dateReserved": "2026-05-18T14:20:09.110Z",
"dateUpdated": "2026-05-18T19:20:22.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8803 (GCVE-0-2026-8803)
Vulnerability from cvelistv5 – Published: 2026-05-18 11:30 – Updated: 2026-05-19 16:20 Disputed
VLAI?
Title
opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash
Summary
A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: "[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function."
Severity ?
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364436 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364436/cti | signaturepermissions-required |
| https://vuldb.com/submit/802561 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| opensourcepos | Open Source Point of Sale |
Affected:
3.4.0
Affected: 3.4.1 Affected: 3.4.2 cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-19T16:19:49.176036Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T16:20:03.549Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*"
],
"modules": [
"Employee Login"
],
"product": "Open Source Point of Sale",
"vendor": "opensourcepos",
"versions": [
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.4.1"
},
{
"status": "affected",
"version": "3.4.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Kamran Saifullah (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: \"[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it\u0027s not actively in use as any password change will use a newer hash function.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-328",
"description": "Use of Weak Hash",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T11:30:08.931Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364436 | opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364436"
},
{
"name": "VDB-364436 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364436/cti"
},
{
"name": "Submit #802561 | opensourcepos Open Source Point of Sale 3.4.1 Weak Encoding for Password",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/802561"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-18T06:43:04.000Z",
"value": "VulDB entry last update"
}
],
"title": "opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8803",
"datePublished": "2026-05-18T11:30:08.931Z",
"dateReserved": "2026-05-18T04:37:54.529Z",
"dateUpdated": "2026-05-19T16:20:03.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8802 (GCVE-0-2026-8802)
Vulnerability from cvelistv5 – Published: 2026-05-18 10:00 – Updated: 2026-05-18 13:12 X_Open Source
VLAI?
Title
opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal
Summary
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.
Severity ?
CWE
- CWE-22 - Path Traversal
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364435 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364435/cti | signaturepermissions-required |
| https://vuldb.com/submit/802559 | third-party-advisory |
| https://github.com/opensourcepos/opensourcepos/se… | broken-link |
| https://github.com/opensourcepos/opensourcepos/pu… | issue-trackingpatch |
| https://github.com/opensourcepos/opensourcepos/co… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| opensourcepos | Open Source Point of Sale |
Affected:
3.4.0
Affected: 3.4.1 Affected: 3.4.2 cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T13:12:17.880373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T13:12:29.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*"
],
"product": "Open Source Point of Sale",
"vendor": "opensourcepos",
"versions": [
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.4.1"
},
{
"status": "affected",
"version": "3.4.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Kamran Saifullah (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T10:00:14.027Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364435 | opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364435"
},
{
"name": "VDB-364435 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364435/cti"
},
{
"name": "Submit #802559 | opensourcepos Open Source Point of Sale 3.4.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/802559"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xq63-3v4g-39r5"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/opensourcepos/opensourcepos/pull/4545"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opensourcepos/opensourcepos/commit/def0c27a0e252668df8d942fc31e16d1edfd7323"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-18T06:43:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8802",
"datePublished": "2026-05-18T10:00:14.027Z",
"dateReserved": "2026-05-18T04:37:48.556Z",
"dateUpdated": "2026-05-18T13:12:29.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8786 (GCVE-0-2026-8786)
Vulnerability from cvelistv5 – Published: 2026-05-18 03:00 – Updated: 2026-05-18 14:28
VLAI?
Title
Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization
Summary
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364410 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364410/cti | signaturepermissions-required |
| https://vuldb.com/submit/812172 | third-party-advisory |
| https://gist.github.com/YLChen-007/1cdc50418f29af… | exploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8786",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:28:11.260470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T14:28:23.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*"
],
"modules": [
"Config API Endpoint"
],
"product": "WeKnora",
"vendor": "Tencent",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
},
{
"status": "affected",
"version": "0.3.3"
},
{
"status": "affected",
"version": "0.3.4"
},
{
"status": "affected",
"version": "0.3.5"
},
{
"status": "affected",
"version": "0.3.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-z (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T03:00:14.994Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364410 | Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364410"
},
{
"name": "VDB-364410 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364410/cti"
},
{
"name": "Submit #812172 | Tencent WeKnora \u003c= v0.3.6 Insecure Direct Object Reference (CWE-639)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/812172"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/1cdc50418f29af7ae671466425e52c7b"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T12:28:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8786",
"datePublished": "2026-05-18T03:00:14.994Z",
"dateReserved": "2026-05-17T10:23:37.846Z",
"dateUpdated": "2026-05-18T14:28:23.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8785 (GCVE-0-2026-8785)
Vulnerability from cvelistv5 – Published: 2026-05-18 02:45 – Updated: 2026-05-18 17:51 X_Freeware
VLAI?
Title
projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection
Summary
A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity ?
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364409 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364409/cti | signaturepermissions-required |
| https://vuldb.com/submit/812010 | third-party-advisory |
| https://github.com/projectworldsofficial/Hospital… | issue-tracking |
| https://github.com/lutherping/CVE | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| projectworlds | hospital-management-system-in-php |
Affected:
1.0
cpe:2.3:a:projectworlds:hospital-management-system-in-php:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8785",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:29:32.914968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T17:51:29.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:projectworlds:hospital-management-system-in-php:*:*:*:*:*:*:*:*"
],
"modules": [
"GET Parameter Handler"
],
"product": "hospital-management-system-in-php",
"vendor": "projectworlds",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "luther (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T02:45:15.001Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364409 | projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364409"
},
{
"name": "VDB-364409 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364409/cti"
},
{
"name": "Submit #812010 | Project Worlds Hospital Management System In PHP Latest SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/812010"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/projectworldsofficial/Hospital-management-system-in-php/issues/8"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/lutherping/CVE"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T12:07:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8785",
"datePublished": "2026-05-18T02:45:15.001Z",
"dateReserved": "2026-05-17T10:01:51.354Z",
"dateUpdated": "2026-05-18T17:51:29.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8784 (GCVE-0-2026-8784)
Vulnerability from cvelistv5 – Published: 2026-05-18 02:30 – Updated: 2026-05-18 12:24 X_Open Source
VLAI?
Title
npitre cramfs-tools cramfsck.c change_file_status symlink
Summary
A vulnerability was detected in npitre cramfs-tools up to 2.2. Affected is the function change_file_status of the file cramfsck.c. Performing a manipulation results in symlink following. The attack requires a local approach. The exploit is now public and may be used. The patch is named b4a3a695c9873f824907bd15659f2a6ac7667b4f. It is recommended to apply a patch to fix this issue.
Severity ?
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364408 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364408/cti | signaturepermissions-required |
| https://vuldb.com/submit/811897 | third-party-advisory |
| https://github.com/npitre/cramfs-tools/issues/13 | exploitissue-tracking |
| https://github.com/npitre/cramfs-tools/issues/13#… | issue-tracking |
| https://github.com/npitre/cramfs-tools/commit/b4a… | patch |
| https://github.com/npitre/cramfs-tools/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| npitre | cramfs-tools |
Affected:
2.0
Affected: 2.1 Affected: 2.2 cpe:2.3:a:npitre:cramfs-tools:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8784",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T12:24:11.194480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T12:24:18.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:npitre:cramfs-tools:*:*:*:*:*:*:*:*"
],
"product": "cramfs-tools",
"vendor": "npitre",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nich0las (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in npitre cramfs-tools up to 2.2. Affected is the function change_file_status of the file cramfsck.c. Performing a manipulation results in symlink following. The attack requires a local approach. The exploit is now public and may be used. The patch is named b4a3a695c9873f824907bd15659f2a6ac7667b4f. It is recommended to apply a patch to fix this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:L/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "Symlink Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Link Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T02:30:13.275Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364408 | npitre cramfs-tools cramfsck.c change_file_status symlink",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364408"
},
{
"name": "VDB-364408 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364408/cti"
},
{
"name": "Submit #811897 | GNU cramfs-tools below v2.2 Symlink Following",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811897"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/npitre/cramfs-tools/issues/13"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/npitre/cramfs-tools/issues/13#issuecomment-4306102583"
},
{
"tags": [
"patch"
],
"url": "https://github.com/npitre/cramfs-tools/commit/b4a3a695c9873f824907bd15659f2a6ac7667b4f"
},
{
"tags": [
"product"
],
"url": "https://github.com/npitre/cramfs-tools/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T12:04:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "npitre cramfs-tools cramfsck.c change_file_status symlink"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8784",
"datePublished": "2026-05-18T02:30:13.275Z",
"dateReserved": "2026-05-17T09:59:14.863Z",
"dateUpdated": "2026-05-18T12:24:18.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8783 (GCVE-0-2026-8783)
Vulnerability from cvelistv5 – Published: 2026-05-18 02:15 – Updated: 2026-05-18 19:27
VLAI?
Title
omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference
Summary
A security vulnerability has been detected in omec-project amf up to 2.1.3-dev. This impacts the function UERadioCapabilityCheckResponse of the file ngap/dispatcher.go. Such manipulation leads to null pointer dereference. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 will fix this issue. Upgrading the affected component is advised. The same pull request fixes multiple security issues.
Severity ?
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364407 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364407/cti | signaturepermissions-required |
| https://vuldb.com/submit/811655 | third-party-advisory |
| https://github.com/omec-project/amf/issues/675 | exploitissue-tracking |
| https://github.com/omec-project/amf/pull/666 | issue-trackingpatch |
| https://github.com/omec-project/amf/releases/tag/v2.2.0 | patch |
| https://github.com/omec-project/amf/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| omec-project | amf |
Affected:
2.1.3-dev
Unaffected: 2.2.0 cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8783",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T19:27:12.464881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T19:27:39.001Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/811655"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:*"
],
"product": "amf",
"vendor": "omec-project",
"versions": [
{
"status": "affected",
"version": "2.1.3-dev"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shovon0203 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in omec-project amf up to 2.1.3-dev. This impacts the function UERadioCapabilityCheckResponse of the file ngap/dispatcher.go. Such manipulation leads to null pointer dereference. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 will fix this issue. Upgrading the affected component is advised. The same pull request fixes multiple security issues."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T02:15:11.485Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364407 | omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364407"
},
{
"name": "VDB-364407 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364407/cti"
},
{
"name": "Submit #811655 | Linux Foundation Projects SD-Core 2.1.1 Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811655"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/omec-project/amf/issues/675"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/omec-project/amf/pull/666"
},
{
"tags": [
"patch"
],
"url": "https://github.com/omec-project/amf/releases/tag/v2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/omec-project/amf/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T12:01:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8783",
"datePublished": "2026-05-18T02:15:11.485Z",
"dateReserved": "2026-05-17T09:56:04.123Z",
"dateUpdated": "2026-05-18T19:27:39.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8782 (GCVE-0-2026-8782)
Vulnerability from cvelistv5 – Published: 2026-05-18 02:00 – Updated: 2026-05-18 20:16
VLAI?
Title
omec-project amf NGAP Message handler.go null pointer dereference
Summary
A weakness has been identified in omec-project amf up to 2.1.3-dev. This affects an unknown function of the file ngap/handler.go of the component NGAP Message Handler. This manipulation causes null pointer dereference. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 mitigates this issue. It is recommended to upgrade the affected component. The same pull request fixes multiple security issues.
Severity ?
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364406 | vdb-entry |
| https://vuldb.com/vuln/364406/cti | signaturepermissions-required |
| https://vuldb.com/submit/811654 | third-party-advisory |
| https://github.com/omec-project/amf/issues/674 | exploitissue-tracking |
| https://github.com/omec-project/amf/pull/666 | issue-trackingpatch |
| https://github.com/omec-project/amf/releases/tag/v2.2.0 | patch |
| https://github.com/omec-project/amf/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| omec-project | amf |
Affected:
2.1.3-dev
Unaffected: 2.2.0 cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8782",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T20:15:48.680586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T20:16:19.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:*"
],
"modules": [
"NGAP Message Handler"
],
"product": "amf",
"vendor": "omec-project",
"versions": [
{
"status": "affected",
"version": "2.1.3-dev"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shovon0203 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in omec-project amf up to 2.1.3-dev. This affects an unknown function of the file ngap/handler.go of the component NGAP Message Handler. This manipulation causes null pointer dereference. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 mitigates this issue. It is recommended to upgrade the affected component. The same pull request fixes multiple security issues."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T02:00:17.310Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364406 | omec-project amf NGAP Message handler.go null pointer dereference",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/364406"
},
{
"name": "VDB-364406 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364406/cti"
},
{
"name": "Submit #811654 | Linux Foundation Projects SD-Core 2.1.1 Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811654"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/omec-project/amf/issues/674"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/omec-project/amf/pull/666"
},
{
"tags": [
"patch"
],
"url": "https://github.com/omec-project/amf/releases/tag/v2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/omec-project/amf/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T12:01:16.000Z",
"value": "VulDB entry last update"
}
],
"title": "omec-project amf NGAP Message handler.go null pointer dereference"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8782",
"datePublished": "2026-05-18T02:00:17.310Z",
"dateReserved": "2026-05-17T09:56:01.676Z",
"dateUpdated": "2026-05-18T20:16:19.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8781 (GCVE-0-2026-8781)
Vulnerability from cvelistv5 – Published: 2026-05-18 01:45 – Updated: 2026-05-18 10:02
VLAI?
Title
omec-project amf handler.go RANConfiguration null pointer dereference
Summary
A security flaw has been discovered in omec-project amf up to 2.1.3-dev. The impacted element is the function RANConfiguration of the file ngap/handler.go. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.2.0 is sufficient to resolve this issue. Upgrading the affected component is recommended. The same pull request fixes multiple security issues.
Severity ?
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364405 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364405/cti | signaturepermissions-required |
| https://vuldb.com/submit/811653 | third-party-advisory |
| https://github.com/omec-project/amf/issues/673 | exploitissue-tracking |
| https://github.com/omec-project/amf/pull/666 | issue-trackingpatch |
| https://github.com/omec-project/amf/releases/tag/v2.2.0 | patch |
| https://github.com/omec-project/amf/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| omec-project | amf |
Affected:
2.1.3-dev
Unaffected: 2.2.0 cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8781",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T10:02:37.506803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T10:02:58.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:*"
],
"product": "amf",
"vendor": "omec-project",
"versions": [
{
"status": "affected",
"version": "2.1.3-dev"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shovon0203 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in omec-project amf up to 2.1.3-dev. The impacted element is the function RANConfiguration of the file ngap/handler.go. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.2.0 is sufficient to resolve this issue. Upgrading the affected component is recommended. The same pull request fixes multiple security issues."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T01:45:11.285Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364405 | omec-project amf handler.go RANConfiguration null pointer dereference",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364405"
},
{
"name": "VDB-364405 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364405/cti"
},
{
"name": "Submit #811653 | Linux Foundation Projects SD-Core 2.1.1 Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811653"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/omec-project/amf/issues/673"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/omec-project/amf/pull/666"
},
{
"tags": [
"patch"
],
"url": "https://github.com/omec-project/amf/releases/tag/v2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/omec-project/amf/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T12:01:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "omec-project amf handler.go RANConfiguration null pointer dereference"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8781",
"datePublished": "2026-05-18T01:45:11.285Z",
"dateReserved": "2026-05-17T09:55:58.968Z",
"dateUpdated": "2026-05-18T10:02:58.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8780 (GCVE-0-2026-8780)
Vulnerability from cvelistv5 – Published: 2026-05-18 01:30 – Updated: 2026-05-18 14:29
VLAI?
Title
omec-project amf NGAP Message dispatcher.go memory corruption
Summary
A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. It is suggested to upgrade the affected component. The same pull request fixes multiple security issues.
Severity ?
CWE
- CWE-119 - Memory Corruption
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364404 | vdb-entry |
| https://vuldb.com/vuln/364404/cti | signaturepermissions-required |
| https://vuldb.com/submit/811617 | third-party-advisory |
| https://github.com/omec-project/amf/issues/670 | exploitissue-tracking |
| https://github.com/omec-project/amf/pull/666 | issue-trackingpatch |
| https://github.com/omec-project/amf/releases/tag/v2.2.0 | patch |
| https://github.com/omec-project/amf/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| omec-project | amf |
Affected:
2.1.3-dev
Unaffected: 2.2.0 cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8780",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:29:03.964979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T14:29:15.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:*"
],
"modules": [
"NGAP Message Handler"
],
"product": "amf",
"vendor": "omec-project",
"versions": [
{
"status": "affected",
"version": "2.1.3-dev"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shovon0203 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. It is suggested to upgrade the affected component. The same pull request fixes multiple security issues."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T01:30:14.757Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364404 | omec-project amf NGAP Message dispatcher.go memory corruption",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/364404"
},
{
"name": "VDB-364404 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364404/cti"
},
{
"name": "Submit #811617 | Linux Foundation Projects SD-Core 2.1.1 Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811617"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/omec-project/amf/issues/670"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/omec-project/amf/pull/666"
},
{
"tags": [
"patch"
],
"url": "https://github.com/omec-project/amf/releases/tag/v2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/omec-project/amf/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T12:01:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "omec-project amf NGAP Message dispatcher.go memory corruption"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8780",
"datePublished": "2026-05-18T01:30:14.757Z",
"dateReserved": "2026-05-17T09:55:56.216Z",
"dateUpdated": "2026-05-18T14:29:15.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8779 (GCVE-0-2026-8779)
Vulnerability from cvelistv5 – Published: 2026-05-18 01:15 – Updated: 2026-05-18 17:51
VLAI?
Title
omec-project amf handler.go NGSetupRequest memory corruption
Summary
A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the function NGSetupRequest of the file ngap/handler.go. Executing a manipulation of the argument InformationElement can lead to memory corruption. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.0 is recommended to address this issue. The affected component should be upgraded. The same pull request fixes multiple security issues.
Severity ?
CWE
- CWE-119 - Memory Corruption
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364403 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364403/cti | signaturepermissions-required |
| https://vuldb.com/submit/811616 | third-party-advisory |
| https://github.com/omec-project/amf/issues/671 | exploitissue-tracking |
| https://github.com/omec-project/amf/pull/666 | issue-trackingpatch |
| https://github.com/omec-project/amf/releases/tag/v2.2.0 | patch |
| https://github.com/omec-project/amf/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| omec-project | amf |
Affected:
2.1.3-dev
Unaffected: 2.2.0 cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8779",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:31:09.511000Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T17:51:33.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:omec-project:amf:*:*:*:*:*:*:*:*"
],
"product": "amf",
"vendor": "omec-project",
"versions": [
{
"status": "affected",
"version": "2.1.3-dev"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shovon0203 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the function NGSetupRequest of the file ngap/handler.go. Executing a manipulation of the argument InformationElement can lead to memory corruption. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.0 is recommended to address this issue. The affected component should be upgraded. The same pull request fixes multiple security issues."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T01:15:12.132Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364403 | omec-project amf handler.go NGSetupRequest memory corruption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364403"
},
{
"name": "VDB-364403 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364403/cti"
},
{
"name": "Submit #811616 | Linux Foundation Projects SD-Core 2.1.1 Memory Corruption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811616"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/omec-project/amf/issues/671"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/omec-project/amf/pull/666"
},
{
"tags": [
"patch"
],
"url": "https://github.com/omec-project/amf/releases/tag/v2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/omec-project/amf/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T12:01:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "omec-project amf handler.go NGSetupRequest memory corruption"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8779",
"datePublished": "2026-05-18T01:15:12.132Z",
"dateReserved": "2026-05-17T09:55:52.168Z",
"dateUpdated": "2026-05-18T17:51:33.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8777 (GCVE-0-2026-8777)
Vulnerability from cvelistv5 – Published: 2026-05-18 01:00 – Updated: 2026-05-18 12:26
VLAI?
Title
Edimax BR-6428NS POST Request formStaDrvSetup command injection
Summary
A vulnerability was found in Edimax BR-6428NS 1.10. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. Performing a manipulation of the argument stadrv_ssid results in command injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364402 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364402/cti | signaturepermissions-required |
| https://vuldb.com/submit/811532 | third-party-advisory |
| https://lavender-bicycle-a5a.notion.site/EDIMAX-B… | exploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8777",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T12:26:47.700137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T12:26:59.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:edimax:br-6428ns_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"POST Request Handler"
],
"product": "BR-6428NS",
"vendor": "Edimax",
"versions": [
{
"status": "affected",
"version": "1.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wxhwxhwxh_tutu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Edimax BR-6428NS 1.10. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. Performing a manipulation of the argument stadrv_ssid results in command injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T01:00:15.494Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364402 | Edimax BR-6428NS POST Request formStaDrvSetup command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364402"
},
{
"name": "VDB-364402 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364402/cti"
},
{
"name": "Submit #811532 | EDIMAX BR-6428NS BR-6428NS_v4_1.10 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811532"
},
{
"tags": [
"exploit"
],
"url": "https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formStaDrvSetup-34b53a41781f80ca940cc467cd15dfc2?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:46:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "Edimax BR-6428NS POST Request formStaDrvSetup command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8777",
"datePublished": "2026-05-18T01:00:15.494Z",
"dateReserved": "2026-05-17T09:41:29.803Z",
"dateUpdated": "2026-05-18T12:26:59.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8776 (GCVE-0-2026-8776)
Vulnerability from cvelistv5 – Published: 2026-05-18 00:45 – Updated: 2026-05-18 19:50
VLAI?
Title
Edimax BR-6428NS POST Request formPPTPSetup buffer overflow
Summary
A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364401 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364401/cti | signaturepermissions-required |
| https://vuldb.com/submit/811531 | third-party-advisory |
| https://lavender-bicycle-a5a.notion.site/EDIMAX-B… | exploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8776",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T19:50:00.140599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T19:50:24.635Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:edimax:br-6428ns_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"POST Request Handler"
],
"product": "BR-6428NS",
"vendor": "Edimax",
"versions": [
{
"status": "affected",
"version": "1.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wxhwxhwxh_tutu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T00:45:09.768Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364401 | Edimax BR-6428NS POST Request formPPTPSetup buffer overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364401"
},
{
"name": "VDB-364401 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364401/cti"
},
{
"name": "Submit #811531 | EDIMAX BR-6428NS BR-6428NS_v4_1.10 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811531"
},
{
"tags": [
"exploit"
],
"url": "https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formPPTPSetup-34b53a41781f8074a88af068842b599e?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:46:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "Edimax BR-6428NS POST Request formPPTPSetup buffer overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8776",
"datePublished": "2026-05-18T00:45:09.768Z",
"dateReserved": "2026-05-17T09:41:27.271Z",
"dateUpdated": "2026-05-18T19:50:24.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8775 (GCVE-0-2026-8775)
Vulnerability from cvelistv5 – Published: 2026-05-18 00:30 – Updated: 2026-05-18 20:15
VLAI?
Title
Edimax BR-6428NS POST Request formL2TPSetup buffer overflow
Summary
A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364400 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364400/cti | signaturepermissions-required |
| https://vuldb.com/submit/811530 | third-party-advisory |
| https://lavender-bicycle-a5a.notion.site/EDIMAX-B… | exploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8775",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T20:14:56.931999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T20:15:08.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:edimax:br-6428ns_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"POST Request Handler"
],
"product": "BR-6428NS",
"vendor": "Edimax",
"versions": [
{
"status": "affected",
"version": "1.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wxhwxhwxh_tutu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T00:30:11.484Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364400 | Edimax BR-6428NS POST Request formL2TPSetup buffer overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364400"
},
{
"name": "VDB-364400 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364400/cti"
},
{
"name": "Submit #811530 | EDIMAX BR-6428NS BR-6428NS_v4_1.10 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811530"
},
{
"tags": [
"exploit"
],
"url": "https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formL2TPSetup-34b53a41781f8046b38bffcc190c5277?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:46:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "Edimax BR-6428NS POST Request formL2TPSetup buffer overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8775",
"datePublished": "2026-05-18T00:30:11.484Z",
"dateReserved": "2026-05-17T09:41:24.726Z",
"dateUpdated": "2026-05-18T20:15:08.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8774 (GCVE-0-2026-8774)
Vulnerability from cvelistv5 – Published: 2026-05-18 00:15 – Updated: 2026-05-18 10:27
VLAI?
Title
Edimax BR-6228NC POST Request mp command injection
Summary
A vulnerability was detected in Edimax BR-6228NC 1.22. Affected by this issue is the function mp of the file /goform/mp of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364399 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364399/cti | signaturepermissions-required |
| https://vuldb.com/submit/811529 | third-party-advisory |
| https://lavender-bicycle-a5a.notion.site/EDIMAX-B… | exploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8774",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T10:24:55.253849Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T10:27:06.268Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:edimax:br-6228nc:*:*:*:*:*:*:*:*"
],
"modules": [
"POST Request Handler"
],
"product": "BR-6228NC",
"vendor": "Edimax",
"versions": [
{
"status": "affected",
"version": "1.22"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wxhwxhwxh_tutu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Edimax BR-6228NC 1.22. Affected by this issue is the function mp of the file /goform/mp of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T00:15:12.846Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364399 | Edimax BR-6228NC POST Request mp command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364399"
},
{
"name": "VDB-364399 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364399/cti"
},
{
"name": "Submit #811529 | EDIMAX BR6228NC BR-6228NCv2 (Version : v1.22) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811529"
},
{
"tags": [
"exploit"
],
"url": "https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6228NC-mp-34b53a41781f80db8aaed24e43ea24b9?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:46:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "Edimax BR-6228NC POST Request mp command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8774",
"datePublished": "2026-05-18T00:15:12.846Z",
"dateReserved": "2026-05-17T09:41:22.179Z",
"dateUpdated": "2026-05-18T10:27:06.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8773 (GCVE-0-2026-8773)
Vulnerability from cvelistv5 – Published: 2026-05-18 00:00 – Updated: 2026-05-18 14:31
VLAI?
Title
linlinjava litemall Database Setting DbUtil.java load argument injection
Summary
A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the function backup/load of the file litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java of the component Database Setting Handler. The manipulation of the argument db/password leads to argument injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364398 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364398/cti | signaturepermissions-required |
| https://vuldb.com/submit/811469 | third-party-advisory |
| https://gist.github.com/A1AAAAAAAAAA1/d5ae30a1774… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| linlinjava | litemall |
Affected:
1.0
Affected: 1.1 Affected: 1.2 Affected: 1.3 Affected: 1.4 Affected: 1.5 Affected: 1.6 Affected: 1.7 Affected: 1.8.0 cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8773",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:31:24.117802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T14:31:39.120Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:*"
],
"modules": [
"Database Setting Handler"
],
"product": "litemall",
"vendor": "linlinjava",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "1.2"
},
{
"status": "affected",
"version": "1.3"
},
{
"status": "affected",
"version": "1.4"
},
{
"status": "affected",
"version": "1.5"
},
{
"status": "affected",
"version": "1.6"
},
{
"status": "affected",
"version": "1.7"
},
{
"status": "affected",
"version": "1.8.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "berna (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the function backup/load of the file litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java of the component Database Setting Handler. The manipulation of the argument db/password leads to argument injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Argument Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T00:00:13.854Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364398 | linlinjava litemall Database Setting DbUtil.java load argument injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364398"
},
{
"name": "VDB-364398 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364398/cti"
},
{
"name": "Submit #811469 | linlinjava litemall up to 1.8.0\t Argument Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811469"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/A1AAAAAAAAAA1/d5ae30a17744459e7cc5902fff32a35b"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:41:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "linlinjava litemall Database Setting DbUtil.java load argument injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8773",
"datePublished": "2026-05-18T00:00:13.854Z",
"dateReserved": "2026-05-17T09:36:19.258Z",
"dateUpdated": "2026-05-18T14:31:39.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8772 (GCVE-0-2026-8772)
Vulnerability from cvelistv5 – Published: 2026-05-17 23:45 – Updated: 2026-05-18 17:51
VLAI?
Title
linlinjava litemall Admin Endpoint sql injection
Summary
A weakness has been identified in linlinjava litemall up to 1.8.0. Affected is an unknown function of the component Admin Endpoint. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364397 | vdb-entry |
| https://vuldb.com/vuln/364397/cti | signaturepermissions-required |
| https://vuldb.com/submit/811468 | third-party-advisory |
| https://gist.github.com/A1AAAAAAAAAA1/bc875f5be52… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| linlinjava | litemall |
Affected:
1.0
Affected: 1.1 Affected: 1.2 Affected: 1.3 Affected: 1.4 Affected: 1.5 Affected: 1.6 Affected: 1.7 Affected: 1.8.0 cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8772",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:35:25.609734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T17:51:36.677Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:*"
],
"modules": [
"Admin Endpoint"
],
"product": "litemall",
"vendor": "linlinjava",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "1.2"
},
{
"status": "affected",
"version": "1.3"
},
{
"status": "affected",
"version": "1.4"
},
{
"status": "affected",
"version": "1.5"
},
{
"status": "affected",
"version": "1.6"
},
{
"status": "affected",
"version": "1.7"
},
{
"status": "affected",
"version": "1.8.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "berna (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in linlinjava litemall up to 1.8.0. Affected is an unknown function of the component Admin Endpoint. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T23:45:10.800Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364397 | linlinjava litemall Admin Endpoint sql injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/364397"
},
{
"name": "VDB-364397 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364397/cti"
},
{
"name": "Submit #811468 | linlinjava litemall up to 1.8.0 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811468"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/A1AAAAAAAAAA1/bc875f5be52b44b2e557c5312e355d47"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:41:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "linlinjava litemall Admin Endpoint sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8772",
"datePublished": "2026-05-17T23:45:10.800Z",
"dateReserved": "2026-05-17T09:36:16.835Z",
"dateUpdated": "2026-05-18T17:51:36.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8771 (GCVE-0-2026-8771)
Vulnerability from cvelistv5 – Published: 2026-05-17 23:30 – Updated: 2026-05-18 12:27
VLAI?
Title
linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection
Summary
A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java of the component Front-end WeChat API. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364396 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364396/cti | signaturepermissions-required |
| https://vuldb.com/submit/811467 | third-party-advisory |
| https://gist.github.com/A1AAAAAAAAAA1/ab8df4181f9… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| linlinjava | litemall |
Affected:
1.0
Affected: 1.1 Affected: 1.2 Affected: 1.3 Affected: 1.4 Affected: 1.5 Affected: 1.6 Affected: 1.7 Affected: 1.8.0 cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8771",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T12:27:31.976856Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T12:27:39.487Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:*"
],
"modules": [
"Front-end WeChat API"
],
"product": "litemall",
"vendor": "linlinjava",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "1.2"
},
{
"status": "affected",
"version": "1.3"
},
{
"status": "affected",
"version": "1.4"
},
{
"status": "affected",
"version": "1.5"
},
{
"status": "affected",
"version": "1.6"
},
{
"status": "affected",
"version": "1.7"
},
{
"status": "affected",
"version": "1.8.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "berna (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java of the component Front-end WeChat API. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T23:30:10.247Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364396 | linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364396"
},
{
"name": "VDB-364396 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364396/cti"
},
{
"name": "Submit #811467 | linlinjava litemall up to 1.8.0 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811467"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/A1AAAAAAAAAA1/ab8df4181f9311cb9e7dad905e9aa512"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:41:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8771",
"datePublished": "2026-05-17T23:30:10.247Z",
"dateReserved": "2026-05-17T09:36:12.776Z",
"dateUpdated": "2026-05-18T12:27:39.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8770 (GCVE-0-2026-8770)
Vulnerability from cvelistv5 – Published: 2026-05-17 23:15 – Updated: 2026-05-18 19:53
VLAI?
Title
continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal
Summary
A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
CWE
- CWE-22 - Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364395 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364395/cti | signaturepermissions-required |
| https://vuldb.com/submit/811428 | third-party-advisory |
| https://gist.github.com/YLChen-007/da04e032993a4b… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| continuedev | continue |
Affected:
1.2.0
Affected: 1.2.1 Affected: 1.2.2 Affected: 1.2.3 Affected: 1.2.4 Affected: 1.2.5 Affected: 1.2.6 Affected: 1.2.7 Affected: 1.2.8 Affected: 1.2.9 Affected: 1.2.10 Affected: 1.2.11 Affected: 1.2.12 Affected: 1.2.13 Affected: 1.2.14 Affected: 1.2.15 Affected: 1.2.16 Affected: 1.2.17 Affected: 1.2.18 Affected: 1.2.19 Affected: 1.2.20 Affected: 1.2.21 Affected: 1.2.22 cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8770",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T19:51:58.409644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T19:53:49.716Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/811428"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"
],
"modules": [
"JSON-RPC Server"
],
"product": "continue",
"vendor": "continuedev",
"versions": [
{
"status": "affected",
"version": "1.2.0"
},
{
"status": "affected",
"version": "1.2.1"
},
{
"status": "affected",
"version": "1.2.2"
},
{
"status": "affected",
"version": "1.2.3"
},
{
"status": "affected",
"version": "1.2.4"
},
{
"status": "affected",
"version": "1.2.5"
},
{
"status": "affected",
"version": "1.2.6"
},
{
"status": "affected",
"version": "1.2.7"
},
{
"status": "affected",
"version": "1.2.8"
},
{
"status": "affected",
"version": "1.2.9"
},
{
"status": "affected",
"version": "1.2.10"
},
{
"status": "affected",
"version": "1.2.11"
},
{
"status": "affected",
"version": "1.2.12"
},
{
"status": "affected",
"version": "1.2.13"
},
{
"status": "affected",
"version": "1.2.14"
},
{
"status": "affected",
"version": "1.2.15"
},
{
"status": "affected",
"version": "1.2.16"
},
{
"status": "affected",
"version": "1.2.17"
},
{
"status": "affected",
"version": "1.2.18"
},
{
"status": "affected",
"version": "1.2.19"
},
{
"status": "affected",
"version": "1.2.20"
},
{
"status": "affected",
"version": "1.2.21"
},
{
"status": "affected",
"version": "1.2.22"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-g (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T23:15:15.257Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364395 | continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364395"
},
{
"name": "VDB-364395 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364395/cti"
},
{
"name": "Submit #811428 | continuedev continue v1.2.22-vscode Path Traversal (CWE-22)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811428"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:35:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8770",
"datePublished": "2026-05-17T23:15:15.257Z",
"dateReserved": "2026-05-17T09:30:17.576Z",
"dateUpdated": "2026-05-18T19:53:49.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8769 (GCVE-0-2026-8769)
Vulnerability from cvelistv5 – Published: 2026-05-17 23:00 – Updated: 2026-05-18 20:13
VLAI?
Title
vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption
Summary
A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364394 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364394/cti | signaturepermissions-required |
| https://vuldb.com/submit/811406 | third-party-advisory |
| https://gist.github.com/YLChen-007/fb1096bc8428be… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vercel | ai |
Affected:
3.0.0
Affected: 3.0.1 Affected: 3.0.2 Affected: 3.0.3 Affected: 3.0.4 Affected: 3.0.5 Affected: 3.0.6 Affected: 3.0.7 Affected: 3.0.8 Affected: 3.0.9 Affected: 3.0.10 Affected: 3.0.11 Affected: 3.0.12 Affected: 3.0.13 Affected: 3.0.14 Affected: 3.0.15 Affected: 3.0.16 Affected: 3.0.17 Affected: 3.0.18 Affected: 3.0.19 Affected: 3.0.20 Affected: 3.0.21 Affected: 3.0.22 Affected: 3.0.23 Affected: 3.0.24 Affected: 3.0.25 Affected: 3.0.26 Affected: 3.0.27 Affected: 3.0.28 Affected: 3.0.29 Affected: 3.0.30 Affected: 3.0.31 Affected: 3.0.32 Affected: 3.0.33 Affected: 3.0.34 Affected: 3.0.35 Affected: 3.0.36 Affected: 3.0.37 Affected: 3.0.38 Affected: 3.0.39 Affected: 3.0.40 Affected: 3.0.41 Affected: 3.0.42 Affected: 3.0.43 Affected: 3.0.44 Affected: 3.0.45 Affected: 3.0.46 Affected: 3.0.47 Affected: 3.0.48 Affected: 3.0.49 Affected: 3.0.50 Affected: 3.0.51 Affected: 3.0.52 Affected: 3.0.53 Affected: 3.0.54 Affected: 3.0.55 Affected: 3.0.56 Affected: 3.0.57 Affected: 3.0.58 Affected: 3.0.59 Affected: 3.0.60 Affected: 3.0.61 Affected: 3.0.62 Affected: 3.0.63 Affected: 3.0.64 Affected: 3.0.65 Affected: 3.0.66 Affected: 3.0.67 Affected: 3.0.68 Affected: 3.0.69 Affected: 3.0.70 Affected: 3.0.71 Affected: 3.0.72 Affected: 3.0.73 Affected: 3.0.74 Affected: 3.0.75 Affected: 3.0.76 Affected: 3.0.77 Affected: 3.0.78 Affected: 3.0.79 Affected: 3.0.80 Affected: 3.0.81 Affected: 3.0.82 Affected: 3.0.83 Affected: 3.0.84 Affected: 3.0.85 Affected: 3.0.86 Affected: 3.0.87 Affected: 3.0.88 Affected: 3.0.89 Affected: 3.0.90 Affected: 3.0.91 Affected: 3.0.92 Affected: 3.0.93 Affected: 3.0.94 Affected: 3.0.95 Affected: 3.0.96 Affected: 3.0.97 cpe:2.3:a:vercel:ai:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8769",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T20:12:31.099819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T20:13:40.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vercel:ai:*:*:*:*:*:*:*:*"
],
"modules": [
"provider-utils"
],
"product": "ai",
"vendor": "vercel",
"versions": [
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.0.1"
},
{
"status": "affected",
"version": "3.0.2"
},
{
"status": "affected",
"version": "3.0.3"
},
{
"status": "affected",
"version": "3.0.4"
},
{
"status": "affected",
"version": "3.0.5"
},
{
"status": "affected",
"version": "3.0.6"
},
{
"status": "affected",
"version": "3.0.7"
},
{
"status": "affected",
"version": "3.0.8"
},
{
"status": "affected",
"version": "3.0.9"
},
{
"status": "affected",
"version": "3.0.10"
},
{
"status": "affected",
"version": "3.0.11"
},
{
"status": "affected",
"version": "3.0.12"
},
{
"status": "affected",
"version": "3.0.13"
},
{
"status": "affected",
"version": "3.0.14"
},
{
"status": "affected",
"version": "3.0.15"
},
{
"status": "affected",
"version": "3.0.16"
},
{
"status": "affected",
"version": "3.0.17"
},
{
"status": "affected",
"version": "3.0.18"
},
{
"status": "affected",
"version": "3.0.19"
},
{
"status": "affected",
"version": "3.0.20"
},
{
"status": "affected",
"version": "3.0.21"
},
{
"status": "affected",
"version": "3.0.22"
},
{
"status": "affected",
"version": "3.0.23"
},
{
"status": "affected",
"version": "3.0.24"
},
{
"status": "affected",
"version": "3.0.25"
},
{
"status": "affected",
"version": "3.0.26"
},
{
"status": "affected",
"version": "3.0.27"
},
{
"status": "affected",
"version": "3.0.28"
},
{
"status": "affected",
"version": "3.0.29"
},
{
"status": "affected",
"version": "3.0.30"
},
{
"status": "affected",
"version": "3.0.31"
},
{
"status": "affected",
"version": "3.0.32"
},
{
"status": "affected",
"version": "3.0.33"
},
{
"status": "affected",
"version": "3.0.34"
},
{
"status": "affected",
"version": "3.0.35"
},
{
"status": "affected",
"version": "3.0.36"
},
{
"status": "affected",
"version": "3.0.37"
},
{
"status": "affected",
"version": "3.0.38"
},
{
"status": "affected",
"version": "3.0.39"
},
{
"status": "affected",
"version": "3.0.40"
},
{
"status": "affected",
"version": "3.0.41"
},
{
"status": "affected",
"version": "3.0.42"
},
{
"status": "affected",
"version": "3.0.43"
},
{
"status": "affected",
"version": "3.0.44"
},
{
"status": "affected",
"version": "3.0.45"
},
{
"status": "affected",
"version": "3.0.46"
},
{
"status": "affected",
"version": "3.0.47"
},
{
"status": "affected",
"version": "3.0.48"
},
{
"status": "affected",
"version": "3.0.49"
},
{
"status": "affected",
"version": "3.0.50"
},
{
"status": "affected",
"version": "3.0.51"
},
{
"status": "affected",
"version": "3.0.52"
},
{
"status": "affected",
"version": "3.0.53"
},
{
"status": "affected",
"version": "3.0.54"
},
{
"status": "affected",
"version": "3.0.55"
},
{
"status": "affected",
"version": "3.0.56"
},
{
"status": "affected",
"version": "3.0.57"
},
{
"status": "affected",
"version": "3.0.58"
},
{
"status": "affected",
"version": "3.0.59"
},
{
"status": "affected",
"version": "3.0.60"
},
{
"status": "affected",
"version": "3.0.61"
},
{
"status": "affected",
"version": "3.0.62"
},
{
"status": "affected",
"version": "3.0.63"
},
{
"status": "affected",
"version": "3.0.64"
},
{
"status": "affected",
"version": "3.0.65"
},
{
"status": "affected",
"version": "3.0.66"
},
{
"status": "affected",
"version": "3.0.67"
},
{
"status": "affected",
"version": "3.0.68"
},
{
"status": "affected",
"version": "3.0.69"
},
{
"status": "affected",
"version": "3.0.70"
},
{
"status": "affected",
"version": "3.0.71"
},
{
"status": "affected",
"version": "3.0.72"
},
{
"status": "affected",
"version": "3.0.73"
},
{
"status": "affected",
"version": "3.0.74"
},
{
"status": "affected",
"version": "3.0.75"
},
{
"status": "affected",
"version": "3.0.76"
},
{
"status": "affected",
"version": "3.0.77"
},
{
"status": "affected",
"version": "3.0.78"
},
{
"status": "affected",
"version": "3.0.79"
},
{
"status": "affected",
"version": "3.0.80"
},
{
"status": "affected",
"version": "3.0.81"
},
{
"status": "affected",
"version": "3.0.82"
},
{
"status": "affected",
"version": "3.0.83"
},
{
"status": "affected",
"version": "3.0.84"
},
{
"status": "affected",
"version": "3.0.85"
},
{
"status": "affected",
"version": "3.0.86"
},
{
"status": "affected",
"version": "3.0.87"
},
{
"status": "affected",
"version": "3.0.88"
},
{
"status": "affected",
"version": "3.0.89"
},
{
"status": "affected",
"version": "3.0.90"
},
{
"status": "affected",
"version": "3.0.91"
},
{
"status": "affected",
"version": "3.0.92"
},
{
"status": "affected",
"version": "3.0.93"
},
{
"status": "affected",
"version": "3.0.94"
},
{
"status": "affected",
"version": "3.0.95"
},
{
"status": "affected",
"version": "3.0.96"
},
{
"status": "affected",
"version": "3.0.97"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-f (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T23:00:13.988Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364394 | vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364394"
},
{
"name": "VDB-364394 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364394/cti"
},
{
"name": "Submit #811406 | vercel ai @ai-sdk/amazon-bedrock@3.0.97 Uncontrolled Resource Consumption (CWE-400)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811406"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:33:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8769",
"datePublished": "2026-05-17T23:00:13.988Z",
"dateReserved": "2026-05-17T09:28:09.002Z",
"dateUpdated": "2026-05-18T20:13:40.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8768 (GCVE-0-2026-8768)
Vulnerability from cvelistv5 – Published: 2026-05-17 22:45 – Updated: 2026-05-18 10:41
VLAI?
Title
vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery
Summary
A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364393 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364393/cti | signaturepermissions-required |
| https://vuldb.com/submit/811404 | third-party-advisory |
| https://vuldb.com/submit/811405 | third-party-advisory |
| https://gist.github.com/YLChen-007/07d149bd68adbe… | related |
| https://gist.github.com/YLChen-007/cf7e47e4dda392… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vercel | ai |
Affected:
3.0.0
Affected: 3.0.1 Affected: 3.0.2 Affected: 3.0.3 Affected: 3.0.4 Affected: 3.0.5 Affected: 3.0.6 Affected: 3.0.7 Affected: 3.0.8 Affected: 3.0.9 Affected: 3.0.10 Affected: 3.0.11 Affected: 3.0.12 Affected: 3.0.13 Affected: 3.0.14 Affected: 3.0.15 Affected: 3.0.16 Affected: 3.0.17 Affected: 3.0.18 Affected: 3.0.19 Affected: 3.0.20 Affected: 3.0.21 Affected: 3.0.22 Affected: 3.0.23 Affected: 3.0.24 Affected: 3.0.25 Affected: 3.0.26 Affected: 3.0.27 Affected: 3.0.28 Affected: 3.0.29 Affected: 3.0.30 Affected: 3.0.31 Affected: 3.0.32 Affected: 3.0.33 Affected: 3.0.34 Affected: 3.0.35 Affected: 3.0.36 Affected: 3.0.37 Affected: 3.0.38 Affected: 3.0.39 Affected: 3.0.40 Affected: 3.0.41 Affected: 3.0.42 Affected: 3.0.43 Affected: 3.0.44 Affected: 3.0.45 Affected: 3.0.46 Affected: 3.0.47 Affected: 3.0.48 Affected: 3.0.49 Affected: 3.0.50 Affected: 3.0.51 Affected: 3.0.52 Affected: 3.0.53 Affected: 3.0.54 Affected: 3.0.55 Affected: 3.0.56 Affected: 3.0.57 Affected: 3.0.58 Affected: 3.0.59 Affected: 3.0.60 Affected: 3.0.61 Affected: 3.0.62 Affected: 3.0.63 Affected: 3.0.64 Affected: 3.0.65 Affected: 3.0.66 Affected: 3.0.67 Affected: 3.0.68 Affected: 3.0.69 Affected: 3.0.70 Affected: 3.0.71 Affected: 3.0.72 Affected: 3.0.73 Affected: 3.0.74 Affected: 3.0.75 Affected: 3.0.76 Affected: 3.0.77 Affected: 3.0.78 Affected: 3.0.79 Affected: 3.0.80 Affected: 3.0.81 Affected: 3.0.82 Affected: 3.0.83 Affected: 3.0.84 Affected: 3.0.85 Affected: 3.0.86 Affected: 3.0.87 Affected: 3.0.88 Affected: 3.0.89 Affected: 3.0.90 Affected: 3.0.91 Affected: 3.0.92 Affected: 3.0.93 Affected: 3.0.94 Affected: 3.0.95 Affected: 3.0.96 Affected: 3.0.97 cpe:2.3:a:vercel:ai:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8768",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T10:28:23.079110Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T10:41:00.465Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vercel:ai:*:*:*:*:*:*:*:*"
],
"modules": [
"provider-utils"
],
"product": "ai",
"vendor": "vercel",
"versions": [
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.0.1"
},
{
"status": "affected",
"version": "3.0.2"
},
{
"status": "affected",
"version": "3.0.3"
},
{
"status": "affected",
"version": "3.0.4"
},
{
"status": "affected",
"version": "3.0.5"
},
{
"status": "affected",
"version": "3.0.6"
},
{
"status": "affected",
"version": "3.0.7"
},
{
"status": "affected",
"version": "3.0.8"
},
{
"status": "affected",
"version": "3.0.9"
},
{
"status": "affected",
"version": "3.0.10"
},
{
"status": "affected",
"version": "3.0.11"
},
{
"status": "affected",
"version": "3.0.12"
},
{
"status": "affected",
"version": "3.0.13"
},
{
"status": "affected",
"version": "3.0.14"
},
{
"status": "affected",
"version": "3.0.15"
},
{
"status": "affected",
"version": "3.0.16"
},
{
"status": "affected",
"version": "3.0.17"
},
{
"status": "affected",
"version": "3.0.18"
},
{
"status": "affected",
"version": "3.0.19"
},
{
"status": "affected",
"version": "3.0.20"
},
{
"status": "affected",
"version": "3.0.21"
},
{
"status": "affected",
"version": "3.0.22"
},
{
"status": "affected",
"version": "3.0.23"
},
{
"status": "affected",
"version": "3.0.24"
},
{
"status": "affected",
"version": "3.0.25"
},
{
"status": "affected",
"version": "3.0.26"
},
{
"status": "affected",
"version": "3.0.27"
},
{
"status": "affected",
"version": "3.0.28"
},
{
"status": "affected",
"version": "3.0.29"
},
{
"status": "affected",
"version": "3.0.30"
},
{
"status": "affected",
"version": "3.0.31"
},
{
"status": "affected",
"version": "3.0.32"
},
{
"status": "affected",
"version": "3.0.33"
},
{
"status": "affected",
"version": "3.0.34"
},
{
"status": "affected",
"version": "3.0.35"
},
{
"status": "affected",
"version": "3.0.36"
},
{
"status": "affected",
"version": "3.0.37"
},
{
"status": "affected",
"version": "3.0.38"
},
{
"status": "affected",
"version": "3.0.39"
},
{
"status": "affected",
"version": "3.0.40"
},
{
"status": "affected",
"version": "3.0.41"
},
{
"status": "affected",
"version": "3.0.42"
},
{
"status": "affected",
"version": "3.0.43"
},
{
"status": "affected",
"version": "3.0.44"
},
{
"status": "affected",
"version": "3.0.45"
},
{
"status": "affected",
"version": "3.0.46"
},
{
"status": "affected",
"version": "3.0.47"
},
{
"status": "affected",
"version": "3.0.48"
},
{
"status": "affected",
"version": "3.0.49"
},
{
"status": "affected",
"version": "3.0.50"
},
{
"status": "affected",
"version": "3.0.51"
},
{
"status": "affected",
"version": "3.0.52"
},
{
"status": "affected",
"version": "3.0.53"
},
{
"status": "affected",
"version": "3.0.54"
},
{
"status": "affected",
"version": "3.0.55"
},
{
"status": "affected",
"version": "3.0.56"
},
{
"status": "affected",
"version": "3.0.57"
},
{
"status": "affected",
"version": "3.0.58"
},
{
"status": "affected",
"version": "3.0.59"
},
{
"status": "affected",
"version": "3.0.60"
},
{
"status": "affected",
"version": "3.0.61"
},
{
"status": "affected",
"version": "3.0.62"
},
{
"status": "affected",
"version": "3.0.63"
},
{
"status": "affected",
"version": "3.0.64"
},
{
"status": "affected",
"version": "3.0.65"
},
{
"status": "affected",
"version": "3.0.66"
},
{
"status": "affected",
"version": "3.0.67"
},
{
"status": "affected",
"version": "3.0.68"
},
{
"status": "affected",
"version": "3.0.69"
},
{
"status": "affected",
"version": "3.0.70"
},
{
"status": "affected",
"version": "3.0.71"
},
{
"status": "affected",
"version": "3.0.72"
},
{
"status": "affected",
"version": "3.0.73"
},
{
"status": "affected",
"version": "3.0.74"
},
{
"status": "affected",
"version": "3.0.75"
},
{
"status": "affected",
"version": "3.0.76"
},
{
"status": "affected",
"version": "3.0.77"
},
{
"status": "affected",
"version": "3.0.78"
},
{
"status": "affected",
"version": "3.0.79"
},
{
"status": "affected",
"version": "3.0.80"
},
{
"status": "affected",
"version": "3.0.81"
},
{
"status": "affected",
"version": "3.0.82"
},
{
"status": "affected",
"version": "3.0.83"
},
{
"status": "affected",
"version": "3.0.84"
},
{
"status": "affected",
"version": "3.0.85"
},
{
"status": "affected",
"version": "3.0.86"
},
{
"status": "affected",
"version": "3.0.87"
},
{
"status": "affected",
"version": "3.0.88"
},
{
"status": "affected",
"version": "3.0.89"
},
{
"status": "affected",
"version": "3.0.90"
},
{
"status": "affected",
"version": "3.0.91"
},
{
"status": "affected",
"version": "3.0.92"
},
{
"status": "affected",
"version": "3.0.93"
},
{
"status": "affected",
"version": "3.0.94"
},
{
"status": "affected",
"version": "3.0.95"
},
{
"status": "affected",
"version": "3.0.96"
},
{
"status": "affected",
"version": "3.0.97"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-f (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T22:45:09.929Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364393 | vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364393"
},
{
"name": "VDB-364393 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364393/cti"
},
{
"name": "Submit #811404 | vercel ai @ai-sdk/amazon-bedrock@3.0.97 Server-Side Request Forgery (SSRF) (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811404"
},
{
"name": "Submit #811405 | vercel ai @ai-sdk/amazon-bedrock@3.0.97 Server-Side Request Forgery (SSRF) (CWE-918) (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811405"
},
{
"tags": [
"related"
],
"url": "https://gist.github.com/YLChen-007/07d149bd68adbee58165b4207a2abc71"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/cf7e47e4dda392f474ca77a66d1d847f"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:33:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8768",
"datePublished": "2026-05-17T22:45:09.929Z",
"dateReserved": "2026-05-17T09:28:06.447Z",
"dateUpdated": "2026-05-18T10:41:00.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8767 (GCVE-0-2026-8767)
Vulnerability from cvelistv5 – Published: 2026-05-17 22:30 – Updated: 2026-05-18 14:30
VLAI?
Title
vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection
Summary
A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364392 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364392/cti | signaturepermissions-required |
| https://vuldb.com/submit/811402 | third-party-advisory |
| https://gist.github.com/YLChen-007/870bd6966cd847… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vercel | ai |
Affected:
3.0.0
Affected: 3.0.1 Affected: 3.0.2 Affected: 3.0.3 Affected: 3.0.4 Affected: 3.0.5 Affected: 3.0.6 Affected: 3.0.7 Affected: 3.0.8 Affected: 3.0.9 Affected: 3.0.10 Affected: 3.0.11 Affected: 3.0.12 Affected: 3.0.13 Affected: 3.0.14 Affected: 3.0.15 Affected: 3.0.16 Affected: 3.0.17 Affected: 3.0.18 Affected: 3.0.19 Affected: 3.0.20 Affected: 3.0.21 Affected: 3.0.22 Affected: 3.0.23 Affected: 3.0.24 Affected: 3.0.25 Affected: 3.0.26 Affected: 3.0.27 Affected: 3.0.28 Affected: 3.0.29 Affected: 3.0.30 Affected: 3.0.31 Affected: 3.0.32 Affected: 3.0.33 Affected: 3.0.34 Affected: 3.0.35 Affected: 3.0.36 Affected: 3.0.37 Affected: 3.0.38 Affected: 3.0.39 Affected: 3.0.40 Affected: 3.0.41 Affected: 3.0.42 Affected: 3.0.43 Affected: 3.0.44 Affected: 3.0.45 Affected: 3.0.46 Affected: 3.0.47 Affected: 3.0.48 Affected: 3.0.49 Affected: 3.0.50 Affected: 3.0.51 Affected: 3.0.52 Affected: 3.0.53 Affected: 3.0.54 Affected: 3.0.55 Affected: 3.0.56 Affected: 3.0.57 Affected: 3.0.58 Affected: 3.0.59 Affected: 3.0.60 Affected: 3.0.61 Affected: 3.0.62 Affected: 3.0.63 Affected: 3.0.64 Affected: 3.0.65 Affected: 3.0.66 Affected: 3.0.67 Affected: 3.0.68 Affected: 3.0.69 Affected: 3.0.70 Affected: 3.0.71 Affected: 3.0.72 Affected: 3.0.73 Affected: 3.0.74 Affected: 3.0.75 Affected: 3.0.76 Affected: 3.0.77 Affected: 3.0.78 Affected: 3.0.79 Affected: 3.0.80 Affected: 3.0.81 Affected: 3.0.82 Affected: 3.0.83 Affected: 3.0.84 Affected: 3.0.85 Affected: 3.0.86 Affected: 3.0.87 Affected: 3.0.88 Affected: 3.0.89 Affected: 3.0.90 Affected: 3.0.91 Affected: 3.0.92 Affected: 3.0.93 Affected: 3.0.94 Affected: 3.0.95 Affected: 3.0.96 Affected: 3.0.97 cpe:2.3:a:vercel:ai:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8767",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:30:43.479216Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T14:30:55.942Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vercel:ai:*:*:*:*:*:*:*:*"
],
"modules": [
"PR Branch Name Interpolation"
],
"product": "ai",
"vendor": "vercel",
"versions": [
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.0.1"
},
{
"status": "affected",
"version": "3.0.2"
},
{
"status": "affected",
"version": "3.0.3"
},
{
"status": "affected",
"version": "3.0.4"
},
{
"status": "affected",
"version": "3.0.5"
},
{
"status": "affected",
"version": "3.0.6"
},
{
"status": "affected",
"version": "3.0.7"
},
{
"status": "affected",
"version": "3.0.8"
},
{
"status": "affected",
"version": "3.0.9"
},
{
"status": "affected",
"version": "3.0.10"
},
{
"status": "affected",
"version": "3.0.11"
},
{
"status": "affected",
"version": "3.0.12"
},
{
"status": "affected",
"version": "3.0.13"
},
{
"status": "affected",
"version": "3.0.14"
},
{
"status": "affected",
"version": "3.0.15"
},
{
"status": "affected",
"version": "3.0.16"
},
{
"status": "affected",
"version": "3.0.17"
},
{
"status": "affected",
"version": "3.0.18"
},
{
"status": "affected",
"version": "3.0.19"
},
{
"status": "affected",
"version": "3.0.20"
},
{
"status": "affected",
"version": "3.0.21"
},
{
"status": "affected",
"version": "3.0.22"
},
{
"status": "affected",
"version": "3.0.23"
},
{
"status": "affected",
"version": "3.0.24"
},
{
"status": "affected",
"version": "3.0.25"
},
{
"status": "affected",
"version": "3.0.26"
},
{
"status": "affected",
"version": "3.0.27"
},
{
"status": "affected",
"version": "3.0.28"
},
{
"status": "affected",
"version": "3.0.29"
},
{
"status": "affected",
"version": "3.0.30"
},
{
"status": "affected",
"version": "3.0.31"
},
{
"status": "affected",
"version": "3.0.32"
},
{
"status": "affected",
"version": "3.0.33"
},
{
"status": "affected",
"version": "3.0.34"
},
{
"status": "affected",
"version": "3.0.35"
},
{
"status": "affected",
"version": "3.0.36"
},
{
"status": "affected",
"version": "3.0.37"
},
{
"status": "affected",
"version": "3.0.38"
},
{
"status": "affected",
"version": "3.0.39"
},
{
"status": "affected",
"version": "3.0.40"
},
{
"status": "affected",
"version": "3.0.41"
},
{
"status": "affected",
"version": "3.0.42"
},
{
"status": "affected",
"version": "3.0.43"
},
{
"status": "affected",
"version": "3.0.44"
},
{
"status": "affected",
"version": "3.0.45"
},
{
"status": "affected",
"version": "3.0.46"
},
{
"status": "affected",
"version": "3.0.47"
},
{
"status": "affected",
"version": "3.0.48"
},
{
"status": "affected",
"version": "3.0.49"
},
{
"status": "affected",
"version": "3.0.50"
},
{
"status": "affected",
"version": "3.0.51"
},
{
"status": "affected",
"version": "3.0.52"
},
{
"status": "affected",
"version": "3.0.53"
},
{
"status": "affected",
"version": "3.0.54"
},
{
"status": "affected",
"version": "3.0.55"
},
{
"status": "affected",
"version": "3.0.56"
},
{
"status": "affected",
"version": "3.0.57"
},
{
"status": "affected",
"version": "3.0.58"
},
{
"status": "affected",
"version": "3.0.59"
},
{
"status": "affected",
"version": "3.0.60"
},
{
"status": "affected",
"version": "3.0.61"
},
{
"status": "affected",
"version": "3.0.62"
},
{
"status": "affected",
"version": "3.0.63"
},
{
"status": "affected",
"version": "3.0.64"
},
{
"status": "affected",
"version": "3.0.65"
},
{
"status": "affected",
"version": "3.0.66"
},
{
"status": "affected",
"version": "3.0.67"
},
{
"status": "affected",
"version": "3.0.68"
},
{
"status": "affected",
"version": "3.0.69"
},
{
"status": "affected",
"version": "3.0.70"
},
{
"status": "affected",
"version": "3.0.71"
},
{
"status": "affected",
"version": "3.0.72"
},
{
"status": "affected",
"version": "3.0.73"
},
{
"status": "affected",
"version": "3.0.74"
},
{
"status": "affected",
"version": "3.0.75"
},
{
"status": "affected",
"version": "3.0.76"
},
{
"status": "affected",
"version": "3.0.77"
},
{
"status": "affected",
"version": "3.0.78"
},
{
"status": "affected",
"version": "3.0.79"
},
{
"status": "affected",
"version": "3.0.80"
},
{
"status": "affected",
"version": "3.0.81"
},
{
"status": "affected",
"version": "3.0.82"
},
{
"status": "affected",
"version": "3.0.83"
},
{
"status": "affected",
"version": "3.0.84"
},
{
"status": "affected",
"version": "3.0.85"
},
{
"status": "affected",
"version": "3.0.86"
},
{
"status": "affected",
"version": "3.0.87"
},
{
"status": "affected",
"version": "3.0.88"
},
{
"status": "affected",
"version": "3.0.89"
},
{
"status": "affected",
"version": "3.0.90"
},
{
"status": "affected",
"version": "3.0.91"
},
{
"status": "affected",
"version": "3.0.92"
},
{
"status": "affected",
"version": "3.0.93"
},
{
"status": "affected",
"version": "3.0.94"
},
{
"status": "affected",
"version": "3.0.95"
},
{
"status": "affected",
"version": "3.0.96"
},
{
"status": "affected",
"version": "3.0.97"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-d (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.6,
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T22:30:09.659Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364392 | vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364392"
},
{
"name": "VDB-364392 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364392/cti"
},
{
"name": "Submit #811402 | vercel ai @ai-sdk/amazon-bedrock@3.0.97 OS Command Injection (CWE-78)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811402"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/870bd6966cd84703d91ce54dfea3bdd0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:33:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8767",
"datePublished": "2026-05-17T22:30:09.659Z",
"dateReserved": "2026-05-17T09:28:03.647Z",
"dateUpdated": "2026-05-18T14:30:55.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8766 (GCVE-0-2026-8766)
Vulnerability from cvelistv5 – Published: 2026-05-17 22:15 – Updated: 2026-05-18 17:51
VLAI?
Title
Kilo-Org kilocode Environment Variable config.ts load information disclosure
Summary
A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILO_CONFIG_CONTENT can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364391 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364391/cti | signaturepermissions-required |
| https://vuldb.com/submit/811400 | third-party-advisory |
| https://gist.github.com/YLChen-007/32b444e49ced1a… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kilo-Org | kilocode |
Affected:
7.0.0
Affected: 7.0.1 Affected: 7.0.2 Affected: 7.0.3 Affected: 7.0.4 Affected: 7.0.5 Affected: 7.0.6 Affected: 7.0.7 Affected: 7.0.8 Affected: 7.0.9 Affected: 7.0.10 Affected: 7.0.11 Affected: 7.0.12 Affected: 7.0.13 Affected: 7.0.14 Affected: 7.0.15 Affected: 7.0.16 Affected: 7.0.17 Affected: 7.0.18 Affected: 7.0.19 Affected: 7.0.20 Affected: 7.0.21 Affected: 7.0.22 Affected: 7.0.23 Affected: 7.0.24 Affected: 7.0.25 Affected: 7.0.26 Affected: 7.0.27 Affected: 7.0.28 Affected: 7.0.29 Affected: 7.0.30 Affected: 7.0.31 Affected: 7.0.32 Affected: 7.0.33 Affected: 7.0.34 Affected: 7.0.35 Affected: 7.0.36 Affected: 7.0.37 Affected: 7.0.38 Affected: 7.0.39 Affected: 7.0.40 Affected: 7.0.41 Affected: 7.0.42 Affected: 7.0.43 Affected: 7.0.44 Affected: 7.0.45 Affected: 7.0.46 Affected: 7.0.47 cpe:2.3:a:kilo-org:kilocode:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8766",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:54:24.339328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T17:51:42.789Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kilo-org:kilocode:*:*:*:*:*:*:*:*"
],
"modules": [
"Environment Variable Handler"
],
"product": "kilocode",
"vendor": "Kilo-Org",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.0.9"
},
{
"status": "affected",
"version": "7.0.10"
},
{
"status": "affected",
"version": "7.0.11"
},
{
"status": "affected",
"version": "7.0.12"
},
{
"status": "affected",
"version": "7.0.13"
},
{
"status": "affected",
"version": "7.0.14"
},
{
"status": "affected",
"version": "7.0.15"
},
{
"status": "affected",
"version": "7.0.16"
},
{
"status": "affected",
"version": "7.0.17"
},
{
"status": "affected",
"version": "7.0.18"
},
{
"status": "affected",
"version": "7.0.19"
},
{
"status": "affected",
"version": "7.0.20"
},
{
"status": "affected",
"version": "7.0.21"
},
{
"status": "affected",
"version": "7.0.22"
},
{
"status": "affected",
"version": "7.0.23"
},
{
"status": "affected",
"version": "7.0.24"
},
{
"status": "affected",
"version": "7.0.25"
},
{
"status": "affected",
"version": "7.0.26"
},
{
"status": "affected",
"version": "7.0.27"
},
{
"status": "affected",
"version": "7.0.28"
},
{
"status": "affected",
"version": "7.0.29"
},
{
"status": "affected",
"version": "7.0.30"
},
{
"status": "affected",
"version": "7.0.31"
},
{
"status": "affected",
"version": "7.0.32"
},
{
"status": "affected",
"version": "7.0.33"
},
{
"status": "affected",
"version": "7.0.34"
},
{
"status": "affected",
"version": "7.0.35"
},
{
"status": "affected",
"version": "7.0.36"
},
{
"status": "affected",
"version": "7.0.37"
},
{
"status": "affected",
"version": "7.0.38"
},
{
"status": "affected",
"version": "7.0.39"
},
{
"status": "affected",
"version": "7.0.40"
},
{
"status": "affected",
"version": "7.0.41"
},
{
"status": "affected",
"version": "7.0.42"
},
{
"status": "affected",
"version": "7.0.43"
},
{
"status": "affected",
"version": "7.0.44"
},
{
"status": "affected",
"version": "7.0.45"
},
{
"status": "affected",
"version": "7.0.46"
},
{
"status": "affected",
"version": "7.0.47"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-d (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILO_CONFIG_CONTENT can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T22:15:08.997Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364391 | Kilo-Org kilocode Environment Variable config.ts load information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364391"
},
{
"name": "VDB-364391 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364391/cti"
},
{
"name": "Submit #811400 | Kilo-Org kilocode 7.0.47 Arbitrary File Read (CWE-200)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811400"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/32b444e49ced1a46bde5a68933ccd09f"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:00:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kilo-Org kilocode Environment Variable config.ts load information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8766",
"datePublished": "2026-05-17T22:15:08.997Z",
"dateReserved": "2026-05-17T08:55:27.777Z",
"dateUpdated": "2026-05-18T17:51:42.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8765 (GCVE-0-2026-8765)
Vulnerability from cvelistv5 – Published: 2026-05-17 22:00 – Updated: 2026-05-18 12:28
VLAI?
Title
Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal
Summary
A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
CWE
- CWE-22 - Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364390 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364390/cti | signaturepermissions-required |
| https://vuldb.com/submit/811401 | third-party-advisory |
| https://gist.github.com/YLChen-007/1770f4530b0c93… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kilo-Org | kilocode |
Affected:
7.0.0
Affected: 7.0.1 Affected: 7.0.2 Affected: 7.0.3 Affected: 7.0.4 Affected: 7.0.5 Affected: 7.0.6 Affected: 7.0.7 Affected: 7.0.8 Affected: 7.0.9 Affected: 7.0.10 Affected: 7.0.11 Affected: 7.0.12 Affected: 7.0.13 Affected: 7.0.14 Affected: 7.0.15 Affected: 7.0.16 Affected: 7.0.17 Affected: 7.0.18 Affected: 7.0.19 Affected: 7.0.20 Affected: 7.0.21 Affected: 7.0.22 Affected: 7.0.23 Affected: 7.0.24 Affected: 7.0.25 Affected: 7.0.26 Affected: 7.0.27 Affected: 7.0.28 Affected: 7.0.29 Affected: 7.0.30 Affected: 7.0.31 Affected: 7.0.32 Affected: 7.0.33 Affected: 7.0.34 Affected: 7.0.35 Affected: 7.0.36 Affected: 7.0.37 Affected: 7.0.38 Affected: 7.0.39 Affected: 7.0.40 Affected: 7.0.41 Affected: 7.0.42 Affected: 7.0.43 Affected: 7.0.44 Affected: 7.0.45 Affected: 7.0.46 Affected: 7.0.47 cpe:2.3:a:kilo-org:kilocode:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8765",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T12:28:03.552410Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T12:28:11.436Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kilo-org:kilocode:*:*:*:*:*:*:*:*"
],
"modules": [
"File Diff API Endpoint"
],
"product": "kilocode",
"vendor": "Kilo-Org",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.0.3"
},
{
"status": "affected",
"version": "7.0.4"
},
{
"status": "affected",
"version": "7.0.5"
},
{
"status": "affected",
"version": "7.0.6"
},
{
"status": "affected",
"version": "7.0.7"
},
{
"status": "affected",
"version": "7.0.8"
},
{
"status": "affected",
"version": "7.0.9"
},
{
"status": "affected",
"version": "7.0.10"
},
{
"status": "affected",
"version": "7.0.11"
},
{
"status": "affected",
"version": "7.0.12"
},
{
"status": "affected",
"version": "7.0.13"
},
{
"status": "affected",
"version": "7.0.14"
},
{
"status": "affected",
"version": "7.0.15"
},
{
"status": "affected",
"version": "7.0.16"
},
{
"status": "affected",
"version": "7.0.17"
},
{
"status": "affected",
"version": "7.0.18"
},
{
"status": "affected",
"version": "7.0.19"
},
{
"status": "affected",
"version": "7.0.20"
},
{
"status": "affected",
"version": "7.0.21"
},
{
"status": "affected",
"version": "7.0.22"
},
{
"status": "affected",
"version": "7.0.23"
},
{
"status": "affected",
"version": "7.0.24"
},
{
"status": "affected",
"version": "7.0.25"
},
{
"status": "affected",
"version": "7.0.26"
},
{
"status": "affected",
"version": "7.0.27"
},
{
"status": "affected",
"version": "7.0.28"
},
{
"status": "affected",
"version": "7.0.29"
},
{
"status": "affected",
"version": "7.0.30"
},
{
"status": "affected",
"version": "7.0.31"
},
{
"status": "affected",
"version": "7.0.32"
},
{
"status": "affected",
"version": "7.0.33"
},
{
"status": "affected",
"version": "7.0.34"
},
{
"status": "affected",
"version": "7.0.35"
},
{
"status": "affected",
"version": "7.0.36"
},
{
"status": "affected",
"version": "7.0.37"
},
{
"status": "affected",
"version": "7.0.38"
},
{
"status": "affected",
"version": "7.0.39"
},
{
"status": "affected",
"version": "7.0.40"
},
{
"status": "affected",
"version": "7.0.41"
},
{
"status": "affected",
"version": "7.0.42"
},
{
"status": "affected",
"version": "7.0.43"
},
{
"status": "affected",
"version": "7.0.44"
},
{
"status": "affected",
"version": "7.0.45"
},
{
"status": "affected",
"version": "7.0.46"
},
{
"status": "affected",
"version": "7.0.47"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-d (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T22:00:13.413Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364390 | Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364390"
},
{
"name": "VDB-364390 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364390/cti"
},
{
"name": "Submit #811401 | Kilo-Org kilocode 7.0.47 Path Traversal (CWE-22)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811401"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/1770f4530b0c933dc61f15b02aa0629d"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T11:00:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8765",
"datePublished": "2026-05-17T22:00:13.413Z",
"dateReserved": "2026-05-17T08:55:25.121Z",
"dateUpdated": "2026-05-18T12:28:11.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8764 (GCVE-0-2026-8764)
Vulnerability from cvelistv5 – Published: 2026-05-17 21:30 – Updated: 2026-05-18 19:55
VLAI?
Title
H3C Magic B3 aspForm UpdateWanParams buffer overflow
Summary
A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364389 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364389/cti | signaturepermissions-required |
| https://vuldb.com/submit/811373 | third-party-advisory |
| https://github.com/yyyy0031/CVE/issues/1 | exploitissue-tracking |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8764",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T19:55:28.710400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T19:55:52.152Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:h3c:magic_b3:*:*:*:*:*:*:*:*"
],
"product": "Magic B3",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "100R002"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yyy0032 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T21:30:11.744Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364389 | H3C Magic B3 aspForm UpdateWanParams buffer overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364389"
},
{
"name": "VDB-364389 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364389/cti"
},
{
"name": "Submit #811373 | New H3C Technologies Co., Ltd. H3C Magic B3 \u003c= 100R002 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811373"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/yyyy0031/CVE/issues/1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-17T10:56:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "H3C Magic B3 aspForm UpdateWanParams buffer overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8764",
"datePublished": "2026-05-17T21:30:11.744Z",
"dateReserved": "2026-05-17T08:51:53.738Z",
"dateUpdated": "2026-05-18T19:55:52.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8759 (GCVE-0-2026-8759)
Vulnerability from cvelistv5 – Published: 2026-05-17 14:15 – Updated: 2026-05-18 20:10
VLAI?
Title
xiandafu beetl SpELFunction SpELFunction.java expression language injection
Summary
A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity ?
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364386 | vdb-entry |
| https://vuldb.com/vuln/364386/cti | signaturepermissions-required |
| https://vuldb.com/submit/811316 | third-party-advisory |
| https://gitee.com/xiandafu/beetl/issues/IIYAWC | broken-linkexploitissue-tracking |
| https://gitee.com/xiandafu/beetl/ | broken-linkproduct |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8759",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T20:10:49.863302Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T20:10:58.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:xiandafu:beetl:*:*:*:*:*:*:*:*"
],
"modules": [
"SpELFunction"
],
"product": "beetl",
"vendor": "xiandafu",
"versions": [
{
"status": "affected",
"version": "3.20.0"
},
{
"status": "affected",
"version": "3.20.1"
},
{
"status": "affected",
"version": "3.20.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pigpig (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/main/java/org/beetl/ext/spring/SpELFunction.java of the component SpELFunction. The manipulation leads to improper neutralization of special elements used in an expression language statement. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-917",
"description": "Improper Neutralization of Special Elements used in an Expression Language Statement",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T14:15:42.240Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364386 | xiandafu beetl SpELFunction SpELFunction.java expression language injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/364386"
},
{
"name": "VDB-364386 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364386/cti"
},
{
"name": "Submit #811316 | Beetl \u003c= 3.20.2.RELEASE Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811316"
},
{
"tags": [
"broken-link",
"exploit",
"issue-tracking"
],
"url": "https://gitee.com/xiandafu/beetl/issues/IIYAWC"
},
{
"tags": [
"broken-link",
"product"
],
"url": "https://gitee.com/xiandafu/beetl/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-16T19:50:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "xiandafu beetl SpELFunction SpELFunction.java expression language injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8759",
"datePublished": "2026-05-17T14:15:42.240Z",
"dateReserved": "2026-05-16T17:44:58.119Z",
"dateUpdated": "2026-05-18T20:10:58.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8758 (GCVE-0-2026-8758)
Vulnerability from cvelistv5 – Published: 2026-05-17 13:45 – Updated: 2026-05-18 10:41
VLAI?
Title
Metasoft 美特软件 MetaCRM upload3.jsp unrestricted upload
Summary
A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364385 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364385/cti | signaturepermissions-required |
| https://vuldb.com/submit/811283 | third-party-advisory |
| https://ucn9h68n9289.feishu.cn/wiki/XmoNwpJjJiQrB… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Metasoft 美特软件 | MetaCRM |
Affected:
6.4.0 Beta06
cpe:2.3:a:metasoft_:metacrm:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8758",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T10:41:38.264789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T10:41:54.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:metasoft_:metacrm:*:*:*:*:*:*:*:*"
],
"product": "MetaCRM",
"vendor": "Metasoft \u7f8e\u7279\u8f6f\u4ef6",
"versions": [
{
"status": "affected",
"version": "6.4.0 Beta06"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "red88-debug (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Metasoft \u7f8e\u7279\u8f6f\u4ef6 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file /common/jsp/upload3.jsp. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T13:45:36.564Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364385 | Metasoft \u7f8e\u7279\u8f6f\u4ef6 MetaCRM upload3.jsp unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364385"
},
{
"name": "VDB-364385 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364385/cti"
},
{
"name": "Submit #811283 | Beijing Meite Software Technology Co., Ltd. MetaCRM6 6.4.0 Beta06 CWE-434 (Unrestricted Upload of File with Dangerous Type)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811283"
},
{
"tags": [
"exploit"
],
"url": "https://ucn9h68n9289.feishu.cn/wiki/XmoNwpJjJiQrBtkLMitccF56ntb"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-16T19:46:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "Metasoft \u7f8e\u7279\u8f6f\u4ef6 MetaCRM upload3.jsp unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8758",
"datePublished": "2026-05-17T13:45:36.564Z",
"dateReserved": "2026-05-16T17:41:11.004Z",
"dateUpdated": "2026-05-18T10:41:54.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8757 (GCVE-0-2026-8757)
Vulnerability from cvelistv5 – Published: 2026-05-17 13:15 – Updated: 2026-05-18 14:30
VLAI?
Title
adenhq hive Delete Request routes_sessions.py _read_events_tail path traversal
Summary
A vulnerability was found in adenhq hive up to 0.11.0. This affects the function _read_events_tail of the file core/framework/server/routes_sessions.py of the component Delete Request Handler. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
CWE
- CWE-22 - Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364384 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364384/cti | signaturepermissions-required |
| https://vuldb.com/submit/811276 | third-party-advisory |
| https://gist.github.com/YLChen-007/ff3ff201b05d13… | exploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8757",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T14:29:49.770752Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T14:30:03.843Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:adenhq:hive:*:*:*:*:*:*:*:*"
],
"modules": [
"Delete Request Handler"
],
"product": "hive",
"vendor": "adenhq",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-b (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in adenhq hive up to 0.11.0. This affects the function _read_events_tail of the file core/framework/server/routes_sessions.py of the component Delete Request Handler. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T13:15:09.780Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364384 | adenhq hive Delete Request routes_sessions.py _read_events_tail path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364384"
},
{
"name": "VDB-364384 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364384/cti"
},
{
"name": "Submit #811276 | adenhq hive latest Path Traversal (CWE-22)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811276"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/ff3ff201b05d13d41f949f86e9187bd2"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-16T19:44:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "adenhq hive Delete Request routes_sessions.py _read_events_tail path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8757",
"datePublished": "2026-05-17T13:15:09.780Z",
"dateReserved": "2026-05-16T17:39:06.425Z",
"dateUpdated": "2026-05-18T14:30:03.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8756 (GCVE-0-2026-8756)
Vulnerability from cvelistv5 – Published: 2026-05-17 13:00 – Updated: 2026-05-18 17:51
VLAI?
Title
fishaudio Bert-VITS2 Gradio webui_preprocess.py generate_config path traversal
Summary
A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file webui_preprocess.py of the component Gradio Interface. Such manipulation of the argument data_dir leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
CWE
- CWE-22 - Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364383 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364383/cti | signaturepermissions-required |
| https://vuldb.com/submit/811175 | third-party-advisory |
| https://gist.github.com/YLChen-007/550cb92f3489c3… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fishaudio | Bert-VITS2 |
Affected:
8f7fbd8c4770965225d258db548da27dc8dd934c
cpe:2.3:a:fishaudio:bert-vits2:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8756",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T15:53:03.563052Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T17:51:48.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fishaudio:bert-vits2:*:*:*:*:*:*:*:*"
],
"modules": [
"Gradio Interface"
],
"product": "Bert-VITS2",
"vendor": "fishaudio",
"versions": [
{
"status": "affected",
"version": "8f7fbd8c4770965225d258db548da27dc8dd934c"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-b (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file webui_preprocess.py of the component Gradio Interface. Such manipulation of the argument data_dir leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T13:00:16.673Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364383 | fishaudio Bert-VITS2 Gradio webui_preprocess.py generate_config path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364383"
},
{
"name": "VDB-364383 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364383/cti"
},
{
"name": "Submit #811175 | fishaudio Bert-VITS2 \u003c= 406b79a Path Traversal (CWE-22)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811175"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/550cb92f3489c317ff049fc7d7ea6b99"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-16T19:42:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "fishaudio Bert-VITS2 Gradio webui_preprocess.py generate_config path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8756",
"datePublished": "2026-05-17T13:00:16.673Z",
"dateReserved": "2026-05-16T17:36:57.785Z",
"dateUpdated": "2026-05-18T17:51:48.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8755 (GCVE-0-2026-8755)
Vulnerability from cvelistv5 – Published: 2026-05-17 12:45 – Updated: 2026-05-18 12:28
VLAI?
Title
fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal
Summary
A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Severity ?
CWE
- CWE-22 - Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364382 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/364382/cti | signaturepermissions-required |
| https://vuldb.com/submit/811173 | third-party-advisory |
| https://gist.github.com/YLChen-007/99859f4f836cca… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fishaudio | Bert-VITS2 |
Affected:
8f7fbd8c4770965225d258db548da27dc8dd934c
cpe:2.3:a:fishaudio:bert-vits2:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8755",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T12:28:36.182784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T12:28:42.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fishaudio:bert-vits2:*:*:*:*:*:*:*:*"
],
"modules": [
"Model Handler"
],
"product": "Bert-VITS2",
"vendor": "fishaudio",
"versions": [
{
"status": "affected",
"version": "8f7fbd8c4770965225d258db548da27dc8dd934c"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-b (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T12:45:09.056Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364382 | fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/364382"
},
{
"name": "VDB-364382 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364382/cti"
},
{
"name": "Submit #811173 | fishaudio Bert-VITS2 latest (commit 724d0b2) Path Traversal (CWE-22)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/811173"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/99859f4f836cca523a5982645e7fdd97"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-16T19:42:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8755",
"datePublished": "2026-05-17T12:45:09.056Z",
"dateReserved": "2026-05-16T17:36:54.626Z",
"dateUpdated": "2026-05-18T12:28:42.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}