Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
11846 vulnerabilities
CVE-2025-71466 (GCVE-0-2025-71466)
Vulnerability from cvelistv5 – Published: 2026-11-15 15:51 – Updated: 2026-11-15 15:51
VLAI
EPSS
VEX
Title
GPAC before 26.02.0 NULL Pointer Dereference via m2tsdmx_update_sdt
Summary
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c that allows attackers to crash the MPEG-2 TS demuxer. Attackers can supply a crafted .ts file with an invalid service descriptor leaving service or provider names NULL to crash MP4Box and cause denial of service.
Severity
5.5 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/gpac/gpac/issues/3267 | issue-tracking |
| https://github.com/gpac/gpac/commit/62714f27c64a3… | patch |
| https://github.com/gpac/gpac/blob/v2.4.0/src/filt… | technical-description |
| https://github.com/sigdevel/pocs/blob/main/res/gp… | exploit |
| https://www.vulncheck.com/advisories/gpac-before-… | third-party-advisory |
Impacted products
Date Public
2025-06-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/gpac/gpac",
"product": "gpac",
"repo": "https://github.com/gpac/gpac",
"vendor": "gpac",
"versions": [
{
"lessThan": "26.02.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.02.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexander A. Shvedov (sigdevel)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Aurelien David"
}
],
"datePublic": "2025-06-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c that allows attackers to crash the MPEG-2 TS demuxer. Attackers can supply a crafted .ts file with an invalid service descriptor leaving service or provider names NULL to crash MP4Box and cause denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T15:51:22.527Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/gpac/gpac/issues/3267"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gpac/gpac/blob/v2.4.0/src/filters/dmx_m2ts.c#L185-L189"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/26/26_m2tsdmx_update_sdt_filters_dmx_m2ts_c_218"
},
{
"name": "VulnCheck Advisory: GPAC before 26.02.0 NULL Pointer Dereference via m2tsdmx_update_sdt",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gpac-before-26.02.0-null-pointer-dereference-via-m2tsdmx-update-sdt"
}
],
"title": "GPAC before 26.02.0 NULL Pointer Dereference via m2tsdmx_update_sdt",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71466",
"datePublished": "2026-11-15T15:51:22.527Z",
"dateReserved": "2026-11-15T15:42:33.480Z",
"dateUpdated": "2026-11-15T15:51:22.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71467 (GCVE-0-2025-71467)
Vulnerability from cvelistv5 – Published: 2026-11-15 15:51 – Updated: 2026-11-15 15:51
VLAI
EPSS
VEX
Title
GPAC before 26.02.0 NULL Pointer Dereference via gf_node_get_field_by_name
Summary
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c that lets attackers crash applications. Attackers can supply a crafted XMT scene referencing a never-created node to crash MP4Box or GPAC scene loader applications, causing denial of service.
Severity
5.5 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/gpac/gpac/issues/3268 | issue-tracking |
| https://github.com/gpac/gpac/commit/62714f27c64a3… | patch |
| https://github.com/gpac/gpac/blob/v2.4.0/src/scen… | technical-description |
| https://github.com/sigdevel/pocs/blob/main/res/gp… | exploit |
| https://www.vulncheck.com/advisories/gpac-before-… | third-party-advisory |
Impacted products
Date Public
2025-06-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/gpac/gpac",
"product": "gpac",
"repo": "https://github.com/gpac/gpac",
"vendor": "gpac",
"versions": [
{
"lessThan": "26.02.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.02.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexander A. Shvedov (sigdevel)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Aurelien David"
}
],
"datePublic": "2025-06-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c that lets attackers crash applications. Attackers can supply a crafted XMT scene referencing a never-created node to crash MP4Box or GPAC scene loader applications, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T15:51:21.844Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/gpac/gpac/issues/3268"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gpac/gpac/blob/v2.4.0/src/scenegraph/base_scenegraph.c#L2083-L2087"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/27/27_gf_node_get_field_by_name_scenegraph_base_scenegraph_c_2088"
},
{
"name": "VulnCheck Advisory: GPAC before 26.02.0 NULL Pointer Dereference via gf_node_get_field_by_name",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gpac-before-26.02.0-null-pointer-dereference-via-gf-node-get-field-by-name"
}
],
"title": "GPAC before 26.02.0 NULL Pointer Dereference via gf_node_get_field_by_name",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71467",
"datePublished": "2026-11-15T15:51:21.844Z",
"dateReserved": "2026-11-15T15:42:33.812Z",
"dateUpdated": "2026-11-15T15:51:21.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71468 (GCVE-0-2025-71468)
Vulnerability from cvelistv5 – Published: 2026-11-15 15:51 – Updated: 2026-11-15 15:51
VLAI
EPSS
VEX
Title
GPAC before 26.02.0 NULL Pointer Dereference via gf_dash_group_get_audio_channels
Summary
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service.
Severity
5.5 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/gpac/gpac/issues/3269 | issue-tracking |
| https://github.com/gpac/gpac/issues/3270 | issue-tracking |
| https://github.com/gpac/gpac/commit/62714f27c64a3… | patch |
| https://github.com/gpac/gpac/blob/v2.4.0/src/medi… | technical-description |
| https://www.vulncheck.com/advisories/gpac-before-… | third-party-advisory |
Impacted products
Date Public
2025-06-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/gpac/gpac",
"product": "gpac",
"repo": "https://github.com/gpac/gpac",
"vendor": "gpac",
"versions": [
{
"lessThan": "26.02.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.02.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexander A. Shvedov (sigdevel)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Aurelien David"
}
],
"datePublic": "2025-06-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T15:51:21.115Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/gpac/gpac/issues/3269"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/gpac/gpac/issues/3270"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gpac/gpac/blob/v2.4.0/src/media_tools/dash_client.c#L10160-L10165"
},
{
"name": "VulnCheck Advisory: GPAC before 26.02.0 NULL Pointer Dereference via gf_dash_group_get_audio_channels",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gpac-before-26.02.0-null-pointer-dereference-via-gf-dash-group-get-audio-channels"
}
],
"title": "GPAC before 26.02.0 NULL Pointer Dereference via gf_dash_group_get_audio_channels",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71468",
"datePublished": "2026-11-15T15:51:21.115Z",
"dateReserved": "2026-11-15T15:42:34.162Z",
"dateUpdated": "2026-11-15T15:51:21.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71469 (GCVE-0-2025-71469)
Vulnerability from cvelistv5 – Published: 2026-11-15 15:51 – Updated: 2026-11-15 15:51
VLAI
EPSS
VEX
Title
GPAC before 26.02.0 Type Confusion DoS via XMT/BT Scene Loader
Summary
GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to ODS_SetupOD() without checking the descriptor tag. Attackers can supply a crafted XMT file with a URL-bearing descriptor that crashes MP4Box or other GPAC-based applications in gf_scene_ns_connect_object(), causing denial of service.
Severity
5.5 (Medium)
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/gpac/gpac/issues/3271 | issue-tracking |
| https://github.com/gpac/gpac/commit/62714f27c64a3… | patch |
| https://github.com/gpac/gpac/blob/v2.4.0/src/filt… | technical-description |
| https://github.com/sigdevel/pocs/blob/main/res/gp… | exploit |
| https://www.vulncheck.com/advisories/gpac-before-… | third-party-advisory |
Impacted products
Date Public
2025-06-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/gpac/gpac",
"product": "gpac",
"repo": "https://github.com/gpac/gpac",
"vendor": "gpac",
"versions": [
{
"lessThan": "26.02.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.02.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexander A. Shvedov (sigdevel)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Aurelien David"
}
],
"datePublic": "2025-06-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to ODS_SetupOD() without checking the descriptor tag. Attackers can supply a crafted XMT file with a URL-bearing descriptor that crashes MP4Box or other GPAC-based applications in gf_scene_ns_connect_object(), causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T15:51:20.419Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/gpac/gpac/issues/3271"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gpac/gpac/commit/62714f27c64a3d1eb7e880f9eed2d38673cb43ce"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gpac/gpac/blob/v2.4.0/src/filters/load_bt_xmt.c#L649-L656"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/30/30_compositor_scene_ns_c_479_in_gf_scene_ns_connect_object"
},
{
"name": "VulnCheck Advisory: GPAC before 26.02.0 Type Confusion DoS via XMT/BT Scene Loader",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gpac-before-26.02.0-type-confusion-dos-via-xmt-bt-scene-loader"
}
],
"title": "GPAC before 26.02.0 Type Confusion DoS via XMT/BT Scene Loader",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71469",
"datePublished": "2026-11-15T15:51:20.419Z",
"dateReserved": "2026-11-15T15:42:34.496Z",
"dateUpdated": "2026-11-15T15:51:20.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71470 (GCVE-0-2025-71470)
Vulnerability from cvelistv5 – Published: 2026-11-15 15:51 – Updated: 2026-11-15 15:51
VLAI
EPSS
VEX
Title
MicroQuickJS before commit 99eed3f Out-of-Bounds Read in build_backtrace
Summary
MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx->sp and ctx->fp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service.
Severity
5.5 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/bellard/mquickjs/issues/24 | issue-tracking |
| https://github.com/bellard/mquickjs/commit/99eed3… | patch |
| https://github.com/sigdevel/pocs/blob/main/res/mq… | exploit |
| https://www.vulncheck.com/advisories/microquickjs… | third-party-advisory |
Impacted products
Date Public
2025-12-25 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/bellard/mquickjs",
"product": "mquickjs",
"repo": "https://github.com/bellard/mquickjs",
"vendor": "bellard",
"versions": [
{
"lessThan": "99eed3f94cb66ea7e02fd3472ca7374dee31bb89",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexander A. Shvedov (sigdevel)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Fabrice Bellard"
}
],
"datePublic": "2025-12-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx-\u003esp and ctx-\u003efp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T15:51:19.706Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/bellard/mquickjs/issues/24"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bellard/mquickjs/commit/99eed3f94cb66ea7e02fd3472ca7374dee31bb89"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/sigdevel/pocs/blob/main/res/mquickjs/1/mquickjs_c_3981"
},
{
"name": "VulnCheck Advisory: MicroQuickJS before commit 99eed3f Out-of-Bounds Read in build_backtrace",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/microquickjs-before-commit-99eed3f-out-of-bounds-read-in-build-backtrace"
}
],
"title": "MicroQuickJS before commit 99eed3f Out-of-Bounds Read in build_backtrace",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71470",
"datePublished": "2026-11-15T15:51:19.706Z",
"dateReserved": "2026-11-15T15:42:34.826Z",
"dateUpdated": "2026-11-15T15:51:19.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129490 (GCVE-0-2026-129490)
Vulnerability from cvelistv5 – Published: 2026-11-15 15:51 – Updated: 2026-11-15 15:51
VLAI
EPSS
VEX
Title
littlefs through 2.11.3 Type Confusion in lfs_dir_traverse via lfs_migrate
Summary
littlefs through 2.11.3, when built with LFS_MIGRATE, contains a type confusion vulnerability in lfs_dir_traverse() that treats a stack lfs_diskoff struct as an lfs_attr array. Attackers can supply a crafted littlefs v1 image whose metadata is read as LFS_FROM_USERATTRS during migration, causing out-of-bounds stack reads and process crashes.
Severity
5.5 (Medium)
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/littlefs-project/littlefs/issu… | issue-tracking |
| https://github.com/littlefs-project/littlefs/blob… | technical-description |
| https://github.com/sigdevel/pocs/blob/main/res/li… | exploit |
| https://www.vulncheck.com/advisories/littlefs-thr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| littlefs-project | littlefs |
Affected:
0 , ≤ 2.11.3
(semver)
|
Date Public
2026-06-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/littlefs-project/littlefs",
"product": "littlefs",
"repo": "https://github.com/littlefs-project/littlefs",
"vendor": "littlefs-project",
"versions": [
{
"lessThanOrEqual": "2.11.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexander A. Shvedov (sigdevel)"
}
],
"datePublic": "2026-06-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "littlefs through 2.11.3, when built with LFS_MIGRATE, contains a type confusion vulnerability in lfs_dir_traverse() that treats a stack lfs_diskoff struct as an lfs_attr array. Attackers can supply a crafted littlefs v1 image whose metadata is read as LFS_FROM_USERATTRS during migration, causing out-of-bounds stack reads and process crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T15:51:19.031Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/littlefs-project/littlefs/issues/1213"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/littlefs-project/littlefs/blob/v2.11.3/lfs.c#L1056-L1063"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/sigdevel/pocs/blob/main/res/littlefs/1/1_lfs_dir_traverse_lfs_c_1059.img"
},
{
"name": "VulnCheck Advisory: littlefs through 2.11.3 Type Confusion in lfs_dir_traverse via lfs_migrate",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/littlefs-through-2.11.3-type-confusion-in-lfs-dir-traverse-via-lfs-migrate"
}
],
"title": "littlefs through 2.11.3 Type Confusion in lfs_dir_traverse via lfs_migrate",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129490",
"datePublished": "2026-11-15T15:51:19.031Z",
"dateReserved": "2026-11-15T15:42:35.162Z",
"dateUpdated": "2026-11-15T15:51:19.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129484 (GCVE-0-2026-129484)
Vulnerability from cvelistv5 – Published: 2026-11-15 15:33 – Updated: 2026-11-15 15:33
VLAI
EPSS
VEX
Title
Kroki before 0.36.0 Reflected XSS via /goat/svg Color Scheme Options
Summary
Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via unvalidated svg-color-dark-scheme and svg-color-light-scheme options. Attackers can craft a GET /goat/svg URL whose option value closes the SVG style element, executing JavaScript in the Kroki origin when victims open it.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/yuzutech/kroki/security/adviso… | vendor-advisory |
| https://github.com/yuzutech/kroki/commit/a0a1435c… | patch |
| https://github.com/yuzutech/kroki/releases/tag/v0.36.0 | release-notes |
| https://github.com/yuzutech/kroki/blob/v0.35.0/se… | technical-description |
| https://www.vulncheck.com/advisories/kroki-before… | third-party-advisory |
Impacted products
Date Public
2026-11-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.kroki/kroki-server",
"product": "kroki",
"repo": "https://github.com/yuzutech/kroki",
"vendor": "yuzutech",
"versions": [
{
"lessThan": "0.36.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.36.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "oceanwarranty (Adgepuk Research)"
}
],
"datePublic": "2026-11-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via unvalidated svg-color-dark-scheme and svg-color-light-scheme options. Attackers can craft a GET /goat/svg URL whose option value closes the SVG style element, executing JavaScript in the Kroki origin when victims open it."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T15:33:11.735Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xp94-px2v-f7f2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/yuzutech/kroki/security/advisories/GHSA-xp94-px2v-f7f2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/yuzutech/kroki/commit/a0a1435cc38eb7b258c555a883b7687424ad6784"
},
{
"name": "kroki v0.36.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/yuzutech/kroki/releases/tag/v0.36.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/yuzutech/kroki/blob/v0.35.0/server/src/main/java/io/kroki/server/service/Goat.java#L61-L71"
},
{
"name": "VulnCheck Advisory: Kroki before 0.36.0 Reflected XSS via /goat/svg Color Scheme Options",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kroki-before-0.36.0-reflected-xss-via-goat-svg-color-scheme-options"
}
],
"title": "Kroki before 0.36.0 Reflected XSS via /goat/svg Color Scheme Options",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129484",
"datePublished": "2026-11-15T15:33:11.735Z",
"dateReserved": "2026-11-15T13:51:17.973Z",
"dateUpdated": "2026-11-15T15:33:11.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129485 (GCVE-0-2026-129485)
Vulnerability from cvelistv5 – Published: 2026-11-15 15:33 – Updated: 2026-11-15 15:33
VLAI
EPSS
VEX
Title
Kroki before 0.36.0 SSRF via BlockDiag Icon and Background Attributes
Summary
Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server.
Severity
5.8 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/yuzutech/kroki/security/adviso… | vendor-advisory |
| https://github.com/yuzutech/kroki/commit/becd3b4a… | patch |
| https://github.com/yuzutech/kroki/releases/tag/v0.36.0 | release-notes |
| https://github.com/yuzutech/kroki/blob/v0.35.0/se… | technical-description |
| https://www.vulncheck.com/advisories/kroki-before… | third-party-advisory |
Impacted products
Date Public
2026-11-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.kroki/kroki-server",
"product": "kroki",
"repo": "https://github.com/yuzutech/kroki",
"vendor": "yuzutech",
"versions": [
{
"lessThan": "0.36.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.36.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "oceanwarranty (Adgepuk Research)"
}
],
"datePublic": "2026-11-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T15:33:11.009Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jwh8-j584-79hp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/yuzutech/kroki/security/advisories/GHSA-jwh8-j584-79hp"
},
{
"tags": [
"patch"
],
"url": "https://github.com/yuzutech/kroki/commit/becd3b4a86754cb08d0fe54f65e92a6cab542409"
},
{
"name": "kroki v0.36.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/yuzutech/kroki/releases/tag/v0.36.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/yuzutech/kroki/blob/v0.35.0/server/src/main/java/io/kroki/server/service/Blockdiag.java#L64-L85"
},
{
"name": "VulnCheck Advisory: Kroki before 0.36.0 SSRF via BlockDiag Icon and Background Attributes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kroki-before-0.36.0-ssrf-via-blockdiag-icon-and-background-attributes"
}
],
"title": "Kroki before 0.36.0 SSRF via BlockDiag Icon and Background Attributes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129485",
"datePublished": "2026-11-15T15:33:11.009Z",
"dateReserved": "2026-11-15T13:51:18.373Z",
"dateUpdated": "2026-11-15T15:33:11.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129482 (GCVE-0-2026-129482)
Vulnerability from cvelistv5 – Published: 2026-11-15 13:47 – Updated: 2026-11-15 13:47
VLAI
EPSS
VEX
Title
OkHttp through 5.5.1 Certificate Pinning Bypass via Trailing-Dot Hostname
Summary
OkHttp through 5.5.1 contains an improper certificate validation vulnerability in CertificatePinner that skips pin checks because Pin.matchesHostname does not normalize trailing-dot hostnames. Network attackers with a CA-trusted certificate not matching configured pins can intercept or modify TLS traffic when applications request the trailing-dot form of pinned hosts.
Severity
4.8 (Medium)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/lysine-dev/okhttp/issues/9724 | issue-tracking |
| https://github.com/lysine-dev/okhttp/pull/9734 | patchissue-tracking |
| https://github.com/lysine-dev/okhttp/commit/30aa5… | patch |
| https://github.com/lysine-dev/okhttp/blob/parent-… | technical-description |
| https://www.vulncheck.com/advisories/okhttp-throu… | third-party-advisory |
Impacted products
Date Public
2026-08-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.squareup.okhttp3/okhttp",
"product": "OkHttp",
"repo": "https://github.com/lysine-dev/okhttp",
"vendor": "Square",
"versions": [
{
"lessThanOrEqual": "5.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:squareup:okhttp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers"
}
],
"datePublic": "2026-08-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OkHttp through 5.5.1 contains an improper certificate validation vulnerability in CertificatePinner that skips pin checks because Pin.matchesHostname does not normalize trailing-dot hostnames. Network attackers with a CA-trusted certificate not matching configured pins can intercept or modify TLS traffic when applications request the trailing-dot form of pinned hosts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T13:47:24.248Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/lysine-dev/okhttp/issues/9724"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/lysine-dev/okhttp/pull/9734"
},
{
"tags": [
"patch"
],
"url": "https://github.com/lysine-dev/okhttp/commit/30aa589761a9b4f5fe84c00e21e5ab44b22bd7c1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/lysine-dev/okhttp/blob/parent-5.5.1/okhttp/src/commonJvmAndroid/kotlin/okhttp3/CertificatePinner.kt#L293-L314"
},
{
"name": "VulnCheck Advisory: OkHttp through 5.5.1 Certificate Pinning Bypass via Trailing-Dot Hostname",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/okhttp-through-5.5.1-certificate-pinning-bypass-via-trailing-dot-hostname"
}
],
"title": "OkHttp through 5.5.1 Certificate Pinning Bypass via Trailing-Dot Hostname",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129482",
"datePublished": "2026-11-15T13:47:24.248Z",
"dateReserved": "2026-11-15T13:41:09.589Z",
"dateUpdated": "2026-11-15T13:47:24.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129483 (GCVE-0-2026-129483)
Vulnerability from cvelistv5 – Published: 2026-11-15 13:47 – Updated: 2026-11-15 13:47
VLAI
EPSS
VEX
Title
Cyrus SASL through 2.1.28 SRP Authentication Bypass via plugins/srp.c
Summary
Cyrus SASL through 2.1.28 contains an authentication bypass vulnerability in the SRP server mechanism because srp_server_mech_step2 does not reject client public values A that are multiples of N. Unauthenticated network clients can send A equal to N to force a zero shared secret, authenticating as any existing user without the password and learning session keys.
Severity
9.1 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/cyrusimap/cyrus-sasl/issues/896 | issue-tracking |
| https://seclists.org/oss-sec/2026/q4/122 | mailing-list |
| https://gist.github.com/afldl/18d15d3f5a1df99411e… | exploit |
| https://github.com/cyrusimap/cyrus-sasl/commit/fb… | patch |
| https://github.com/cyrusimap/cyrus-sasl/blob/cyru… | technical-description |
| https://www.vulncheck.com/advisories/cyrus-sasl-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cyrusimap | cyrus-sasl |
Affected:
0 , ≤ 2.1.28
(semver)
cpe:2.3:a:cyrusimap:cyrus-sasl:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/cyrusimap/cyrus-sasl",
"product": "cyrus-sasl",
"repo": "https://github.com/cyrusimap/cyrus-sasl",
"vendor": "cyrusimap",
"versions": [
{
"lessThanOrEqual": "2.1.28",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cyrusimap:cyrus-sasl:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.1.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "afldl"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cyrus SASL through 2.1.28 contains an authentication bypass vulnerability in the SRP server mechanism because srp_server_mech_step2 does not reject client public values A that are multiples of N. Unauthenticated network clients can send A equal to N to force a zero shared secret, authenticating as any existing user without the password and learning session keys."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T13:47:23.552Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/cyrusimap/cyrus-sasl/issues/896"
},
{
"tags": [
"mailing-list"
],
"url": "https://seclists.org/oss-sec/2026/q4/122"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/afldl/18d15d3f5a1df99411e35000c7de80db"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cyrusimap/cyrus-sasl/commit/fb3724f43dc50247ff2bf02135457d6d77031654"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/cyrusimap/cyrus-sasl/blob/cyrus-sasl-2.1.28/plugins/srp.c#L2046-L2050"
},
{
"name": "VulnCheck Advisory: Cyrus SASL through 2.1.28 SRP Authentication Bypass via plugins/srp.c",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cyrus-sasl-through-2.1.28-srp-authentication-bypass-via-plugins-srp-c"
}
],
"title": "Cyrus SASL through 2.1.28 SRP Authentication Bypass via plugins/srp.c",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129483",
"datePublished": "2026-11-15T13:47:23.552Z",
"dateReserved": "2026-11-15T13:41:10.001Z",
"dateUpdated": "2026-11-15T13:47:23.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129477 (GCVE-0-2026-129477)
Vulnerability from cvelistv5 – Published: 2026-11-15 13:12 – Updated: 2026-11-15 13:12
VLAI
EPSS
VEX
Title
Assimp through 6.0.6 Path Traversal via glTF External Buffer URIs
Summary
Assimp through 6.0.6 contains a path traversal vulnerability in the glTF and glTF2 importers that allows attackers to read local files via crafted buffers[].uri values. Attackers can supply glTF models with '..' segments or absolute paths in buffer URIs to load files like /etc/passwd into imported mesh vertex data.
Severity
5.5 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/assimp/assimp/issues/6933 | issue-tracking |
| https://github.com/assimp/assimp/pull/7027 | issue-trackingpatch |
| https://github.com/assimp/assimp/blob/v6.0.6/code… | technical-description |
| https://www.vulncheck.com/advisories/assimp-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/assimp/assimp",
"product": "assimp",
"repo": "https://github.com/assimp/assimp",
"vendor": "assimp",
"versions": [
{
"lessThanOrEqual": "6.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Assimp through 6.0.6 contains a path traversal vulnerability in the glTF and glTF2 importers that allows attackers to read local files via crafted buffers[].uri values. Attackers can supply glTF models with \u0027..\u0027 segments or absolute paths in buffer URIs to load files like /etc/passwd into imported mesh vertex data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T13:12:10.535Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/assimp/assimp/issues/6933"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/assimp/assimp/pull/7027"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/assimp/assimp/blob/v6.0.6/code/AssetLib/glTF2/glTF2Asset.inl#L608-L612"
},
{
"name": "VulnCheck Advisory: Assimp through 6.0.6 Path Traversal via glTF External Buffer URIs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/assimp-through-6.0.6-path-traversal-via-gltf-external-buffer-uris"
}
],
"title": "Assimp through 6.0.6 Path Traversal via glTF External Buffer URIs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129477",
"datePublished": "2026-11-15T13:12:10.535Z",
"dateReserved": "2026-11-15T13:04:44.586Z",
"dateUpdated": "2026-11-15T13:12:10.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129478 (GCVE-0-2026-129478)
Vulnerability from cvelistv5 – Published: 2026-11-15 13:12 – Updated: 2026-11-15 13:12
VLAI
EPSS
VEX
Title
Assimp through 6.0.6 Heap Out-of-Bounds Read via glTF ParseDataURI
Summary
Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in glTFCommon::Util::ParseDataURI caused by storing the data offset in a signed char. Attackers can supply a crafted glTF file with a raw data URI whose segment starts beyond byte 127 to crash applications or leak adjacent heap memory.
Severity
6.1 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/assimp/assimp/issues/6927 | issue-tracking |
| https://github.com/assimp/assimp/pull/7029 | issue-trackingpatch |
| https://github.com/assimp/assimp/blob/v6.0.6/code… | technical-description |
| https://www.vulncheck.com/advisories/assimp-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/assimp/assimp",
"product": "assimp",
"repo": "https://github.com/assimp/assimp",
"vendor": "assimp",
"versions": [
{
"lessThanOrEqual": "6.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in glTFCommon::Util::ParseDataURI caused by storing the data offset in a signed char. Attackers can supply a crafted glTF file with a raw data URI whose segment starts beyond byte 127 to crash applications or leak adjacent heap memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T13:12:09.837Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/assimp/assimp/issues/6927"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/assimp/assimp/pull/7029"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/assimp/assimp/blob/v6.0.6/code/AssetLib/glTFCommon/glTFCommon.cpp#L86-L105"
},
{
"name": "VulnCheck Advisory: Assimp through 6.0.6 Heap Out-of-Bounds Read via glTF ParseDataURI",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/assimp-through-6.0.6-heap-out-of-bounds-read-via-gltf-parsedatauri"
}
],
"title": "Assimp through 6.0.6 Heap Out-of-Bounds Read via glTF ParseDataURI",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129478",
"datePublished": "2026-11-15T13:12:09.837Z",
"dateReserved": "2026-11-15T13:04:44.988Z",
"dateUpdated": "2026-11-15T13:12:09.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129479 (GCVE-0-2026-129479)
Vulnerability from cvelistv5 – Published: 2026-11-15 13:12 – Updated: 2026-11-15 13:12
VLAI
EPSS
VEX
Title
Assimp through 6.0.6 Integer Overflow via OgreBinarySerializer::ReadSubMesh
Summary
Assimp through 6.0.6 contains an integer overflow vulnerability in OgreBinarySerializer::ReadSubMesh that allows attackers to crash applications by supplying crafted Ogre binary .mesh files. Attackers can set a large index count so the 32-bit buffer size wraps, causing a segmentation fault in aiMesh::~aiMesh() during scene teardown.
Severity
5.5 (Medium)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/assimp/assimp/issues/6930 | issue-tracking |
| https://github.com/assimp/assimp/pull/7026 | issue-trackingpatch |
| https://github.com/assimp/assimp/blob/v6.0.6/code… | technical-description |
| https://www.vulncheck.com/advisories/assimp-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/assimp/assimp",
"product": "assimp",
"repo": "https://github.com/assimp/assimp",
"vendor": "assimp",
"versions": [
{
"lessThanOrEqual": "6.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Assimp through 6.0.6 contains an integer overflow vulnerability in OgreBinarySerializer::ReadSubMesh that allows attackers to crash applications by supplying crafted Ogre binary .mesh files. Attackers can set a large index count so the 32-bit buffer size wraps, causing a segmentation fault in aiMesh::~aiMesh() during scene teardown."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T13:12:09.121Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/assimp/assimp/issues/6930"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/assimp/assimp/pull/7026"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/assimp/assimp/blob/v6.0.6/code/AssetLib/Ogre/OgreBinarySerializer.cpp#L362-L374"
},
{
"name": "VulnCheck Advisory: Assimp through 6.0.6 Integer Overflow via OgreBinarySerializer::ReadSubMesh",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/assimp-through-6.0.6-integer-overflow-via-ogrebinaryserializer-readsubmesh"
}
],
"title": "Assimp through 6.0.6 Integer Overflow via OgreBinarySerializer::ReadSubMesh",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129479",
"datePublished": "2026-11-15T13:12:09.121Z",
"dateReserved": "2026-11-15T13:04:45.379Z",
"dateUpdated": "2026-11-15T13:12:09.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129480 (GCVE-0-2026-129480)
Vulnerability from cvelistv5 – Published: 2026-11-15 13:12 – Updated: 2026-11-15 13:12
VLAI
EPSS
VEX
Title
Assimp through 6.0.6 Heap Out-of-Bounds Read via MD2 Importer frameSize
Summary
Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in MD2Importer::InternReadFile that allows attackers to read past the file buffer via an unvalidated stored frameSize header field. Attackers can supply a crafted .md2 file loaded with a non-zero keyframe selected to crash the application or leak adjacent heap memory into the imported mesh.
Severity
5.3 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/assimp/assimp/issues/6932 | issue-tracking |
| https://github.com/assimp/assimp/pull/7028 | issue-trackingpatch |
| https://github.com/assimp/assimp/blob/v6.0.6/code… | technical-description |
| https://www.vulncheck.com/advisories/assimp-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/assimp/assimp",
"product": "assimp",
"repo": "https://github.com/assimp/assimp",
"vendor": "assimp",
"versions": [
{
"lessThanOrEqual": "6.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:assimp:assimp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in MD2Importer::InternReadFile that allows attackers to read past the file buffer via an unvalidated stored frameSize header field. Attackers can supply a crafted .md2 file loaded with a non-zero keyframe selected to crash the application or leak adjacent heap memory into the imported mesh."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T13:12:08.415Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/assimp/assimp/issues/6932"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/assimp/assimp/pull/7028"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/assimp/assimp/blob/v6.0.6/code/AssetLib/MD2/MD2Loader.cpp#L262-L276"
},
{
"name": "VulnCheck Advisory: Assimp through 6.0.6 Heap Out-of-Bounds Read via MD2 Importer frameSize",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/assimp-through-6.0.6-heap-out-of-bounds-read-via-md2-importer-framesize"
}
],
"title": "Assimp through 6.0.6 Heap Out-of-Bounds Read via MD2 Importer frameSize",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129480",
"datePublished": "2026-11-15T13:12:08.415Z",
"dateReserved": "2026-11-15T13:04:45.761Z",
"dateUpdated": "2026-11-15T13:12:08.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129467 (GCVE-0-2026-129467)
Vulnerability from cvelistv5 – Published: 2026-11-15 12:48 – Updated: 2026-11-15 12:48
VLAI
EPSS
VEX
Title
GeoPulse 1.5.0 through 2.3.0 IDOR via Geocoding Place-Details Endpoint
Summary
GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET /api/v1/places/geocoding/{id} that allows authenticated users to read other users' private locations. Attackers can enumerate sequential reverse_geocoding_location ids to retrieve other users' custom place names, city, country, coordinates and bounding boxes from their history.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieund/geopulse-geocoding-plac… | third-party-advisory |
| https://github.com/tess1o/geopulse/issues/672 | issue-tracking |
| https://github.com/tess1o/geopulse/pull/673 | patchissue-tracking |
| https://github.com/tess1o/geopulse/commit/b994ec5… | patch |
| https://github.com/tess1o/geopulse/blob/v2.3.0/ba… | technical-description |
| https://www.vulncheck.com/advisories/geopulse-1.5… | third-party-advisory |
Impacted products
Date Public
2026-11-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/tess1o/geopulse",
"product": "GeoPulse",
"repo": "https://github.com/tess1o/geopulse",
"vendor": "tess1o",
"versions": [
{
"lessThanOrEqual": "2.3.0",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET /api/v1/places/geocoding/{id} that allows authenticated users to read other users\u0027 private locations. Attackers can enumerate sequential reverse_geocoding_location ids to retrieve other users\u0027 custom place names, city, country, coordinates and bounding boxes from their history."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T12:48:24.360Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieund/geopulse-geocoding-place-details-cross-user-idor"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/tess1o/geopulse/issues/672"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/tess1o/geopulse/pull/673"
},
{
"tags": [
"patch"
],
"url": "https://github.com/tess1o/geopulse/commit/b994ec588b75357a6da743b0389fcae3c4fa4925"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/tess1o/geopulse/blob/v2.3.0/backend/src/main/java/org/github/tess1o/geopulse/streaming/service/PlaceDetailsService.java#L272-L301"
},
{
"name": "VulnCheck Advisory: GeoPulse 1.5.0 through 2.3.0 IDOR via Geocoding Place-Details Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/geopulse-1.5.0-through-2.3.0-idor-via-geocoding-place-details-endpoint"
}
],
"title": "GeoPulse 1.5.0 through 2.3.0 IDOR via Geocoding Place-Details Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129467",
"datePublished": "2026-11-15T12:48:24.360Z",
"dateReserved": "2026-11-15T02:02:14.019Z",
"dateUpdated": "2026-11-15T12:48:24.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129468 (GCVE-0-2026-129468)
Vulnerability from cvelistv5 – Published: 2026-11-15 12:48 – Updated: 2026-11-15 12:48
VLAI
EPSS
VEX
Title
Netcccyun dnsmgr 2.18 before 2.22 Missing Authorization via get_domain_default_line
Summary
Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST /cloudflare/get_domain_default_line that allows restricted users to access domains outside their permissions. Restricted sub-users or single-domain logins can iterate the domain_id parameter to enumerate panel domain ids and read each domain's DNS line list and default line.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieund/dnsmgr-cloudflare-defau… | third-party-advisory |
| https://github.com/netcccyun/dnsmgr/issues/580 | issue-tracking |
| https://github.com/netcccyun/dnsmgr/commit/175468… | patch |
| https://github.com/netcccyun/dnsmgr/blob/b42dbcf8… | technical-description |
| https://www.vulncheck.com/advisories/netcccyun-dn… | third-party-advisory |
Impacted products
Date Public
2026-11-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/netcccyun/dnsmgr",
"product": "dnsmgr",
"repo": "https://github.com/netcccyun/dnsmgr",
"vendor": "netcccyun",
"versions": [
{
"lessThan": "2.22",
"status": "affected",
"version": "2.18",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST /cloudflare/get_domain_default_line that allows restricted users to access domains outside their permissions. Restricted sub-users or single-domain logins can iterate the domain_id parameter to enumerate panel domain ids and read each domain\u0027s DNS line list and default line."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T12:48:23.670Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieund/dnsmgr-cloudflare-default-line-missing-authz-cross-tenant-idor"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/netcccyun/dnsmgr/issues/580"
},
{
"tags": [
"patch"
],
"url": "https://github.com/netcccyun/dnsmgr/commit/175468c6423c04a6b46e56663c37f090bef5381f"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/netcccyun/dnsmgr/blob/b42dbcf88bccca287e9e9af53e87ba399a5ae295/app/controller/Cloudflare.php#L381-L398"
},
{
"name": "VulnCheck Advisory: Netcccyun dnsmgr 2.18 before 2.22 Missing Authorization via get_domain_default_line",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcccyun-dnsmgr-2.18-before-2.22-missing-authorization-via-get-domain-default-line"
}
],
"title": "Netcccyun dnsmgr 2.18 before 2.22 Missing Authorization via get_domain_default_line",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129468",
"datePublished": "2026-11-15T12:48:23.670Z",
"dateReserved": "2026-11-15T02:02:14.385Z",
"dateUpdated": "2026-11-15T12:48:23.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129469 (GCVE-0-2026-129469)
Vulnerability from cvelistv5 – Published: 2026-11-15 12:48 – Updated: 2026-11-15 12:48
VLAI
EPSS
VEX
Title
Course-tencent-cloud before 2.0.2 IDOR via /api/refund/confirm
Summary
Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users' refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines.
Severity
5.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieund/course-tencent-cloud-re… | third-party-advisory |
| https://github.com/xiaochong0302/course-tencent-c… | issue-tracking |
| https://github.com/xiaochong0302/course-tencent-c… | patch |
| https://github.com/xiaochong0302/course-tencent-c… | technical-description |
| https://github.com/xiaochong0302/course-tencent-c… | technical-description |
| https://www.vulncheck.com/advisories/course-tence… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xiaochong0302 | course-tencent-cloud |
Affected:
1.0.0-beta1 , < 2.0.2
(semver)
|
Date Public
2026-11-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/xiaochong0302/course-tencent-cloud",
"product": "course-tencent-cloud",
"repo": "https://github.com/xiaochong0302/course-tencent-cloud",
"vendor": "xiaochong0302",
"versions": [
{
"lessThan": "2.0.2",
"status": "affected",
"version": "1.0.0-beta1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to view other users\u0027 refund previews by supplying an order sn to /api/refund/confirm. Attackers can compute valid sn values from Sqids-encoded sequential order ids using the default key to disclose ordered items, prices, refund amounts, fees and deadlines."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T12:48:22.966Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieund/course-tencent-cloud-refund-confirm-missing-owner-check-idor"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/xiaochong0302/course-tencent-cloud/issues/38"
},
{
"tags": [
"patch"
],
"url": "https://github.com/xiaochong0302/course-tencent-cloud/commit/8e8bcb4e13795006e16d51158790ce3120c8164a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xiaochong0302/course-tencent-cloud/blob/v2.0.1/app/Http/Api/Controllers/RefundController.php#L24-L33"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xiaochong0302/course-tencent-cloud/blob/v2.0.1/app/Http/Home/Controllers/RefundController.php#L49-L64"
},
{
"name": "VulnCheck Advisory: Course-tencent-cloud before 2.0.2 IDOR via /api/refund/confirm",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/course-tencent-cloud-before-2.0.2-idor-via-api-refund-confirm"
}
],
"title": "Course-tencent-cloud before 2.0.2 IDOR via /api/refund/confirm",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129469",
"datePublished": "2026-11-15T12:48:22.966Z",
"dateReserved": "2026-11-15T02:02:14.744Z",
"dateUpdated": "2026-11-15T12:48:22.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129454 (GCVE-0-2026-129454)
Vulnerability from cvelistv5 – Published: 2026-11-15 01:49 – Updated: 2026-11-15 01:49
VLAI
EPSS
VEX
Title
Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint
Summary
Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users' approval requests, including submitted form contents, applicant details and approval records.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vul.yulun.ac.cn/20261114/zr-admin-net/ | third-party-advisory |
| https://github.com/izhaorui/Zr.Admin.NET/issues/27 | issue-tracking |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/commit/8… | technical-descriptionpatch |
| https://www.vulncheck.com/advisories/zr-admin-net… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| izhaorui | Zr.Admin.NET |
Affected:
85cff6ae22389c241d3a4efe178273966650f7ca , ≤ eb9228a23014f6000c06cab2f10ae0d44ecbbd3a
(git)
|
Date Public
2026-11-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"product": "Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET",
"vendor": "izhaorui",
"versions": [
{
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"version": "85cff6ae22389c241d3a4efe178273966650f7ca",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
}
],
"datePublic": "2026-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others\u0027 workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users\u0027 approval requests, including submitted form contents, applicant details and approval records."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T01:49:37.777Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Workflow/Controllers/WfFlowInstanceController.cs#L49-L57"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Workflow/Service/WfFlowInstanceService.cs#L173-L176"
},
{
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/commit/85cff6ae22389c241d3a4efe178273966650f7ca"
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-85cff6a-through-eb9228a-idor-via-workflow-instance-endpoint"
}
],
"title": "Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129454",
"datePublished": "2026-11-15T01:49:37.777Z",
"dateReserved": "2026-11-14T19:03:25.715Z",
"dateUpdated": "2026-11-15T01:49:37.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129455 (GCVE-0-2026-129455)
Vulnerability from cvelistv5 – Published: 2026-11-15 01:49 – Updated: 2026-11-15 01:49
VLAI
EPSS
VEX
Title
Zr.Admin.NET commit e6ceaf4 through eb9228a IDOR via front/article API
Summary
Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}.
Severity
5.4 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vul.yulun.ac.cn/20261114/zr-admin-net/ | third-party-advisory |
| https://github.com/izhaorui/Zr.Admin.NET/issues/27 | issue-tracking |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://www.vulncheck.com/advisories/zr-admin-net… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| izhaorui | Zr.Admin.NET |
Affected:
e6ceaf47548f1a485f3ba3f4c139905e90fee0a2 , ≤ eb9228a23014f6000c06cab2f10ae0d44ecbbd3a
(git)
|
Date Public
2026-11-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"product": "Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET",
"vendor": "izhaorui",
"versions": [
{
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"version": "e6ceaf47548f1a485f3ba3f4c139905e90fee0a2",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
}
],
"datePublic": "2026-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users\u0027 article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T01:49:37.095Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/Content/FrontArticleController.cs#L122-L148"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Service/Content/ArticleService.cs#L402-L437"
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit e6ceaf4 through eb9228a IDOR via front/article API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-e6ceaf4-through-eb9228a-idor-via-front-article-api"
}
],
"title": "Zr.Admin.NET commit e6ceaf4 through eb9228a IDOR via front/article API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129455",
"datePublished": "2026-11-15T01:49:37.095Z",
"dateReserved": "2026-11-14T19:03:26.080Z",
"dateUpdated": "2026-11-15T01:49:37.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129464 (GCVE-0-2026-129464)
Vulnerability from cvelistv5 – Published: 2026-11-15 01:49 – Updated: 2026-11-15 01:49
VLAI
EPSS
VEX
Title
Zr.Admin.NET commit 0ee1ab8 through eb9228a Path Traversal via DownloadFile
Summary
Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vul.yulun.ac.cn/20261114/zr-admin-net/ | third-party-advisory |
| https://github.com/izhaorui/Zr.Admin.NET/issues/27 | issue-tracking |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/commit/0… | technical-descriptionpatch |
| https://www.vulncheck.com/advisories/zr-admin-net… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| izhaorui | Zr.Admin.NET |
Affected:
0ee1ab8af5e3861766746d25acba1184111befcb , ≤ eb9228a23014f6000c06cab2f10ae0d44ecbbd3a
(git)
|
Date Public
2026-11-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"product": "Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET",
"vendor": "izhaorui",
"versions": [
{
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"version": "0ee1ab8af5e3861766746d25acba1184111befcb",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
}
],
"datePublic": "2026-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T01:49:36.388Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/CommonController.cs#L220-L241"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/Infrastructure/Controllers/BaseController.cs#L110-L119"
},
{
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/commit/0ee1ab8af5e3861766746d25acba1184111befcb"
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit 0ee1ab8 through eb9228a Path Traversal via DownloadFile",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-0ee1ab8-through-eb9228a-path-traversal-via-downloadfile"
}
],
"title": "Zr.Admin.NET commit 0ee1ab8 through eb9228a Path Traversal via DownloadFile",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129464",
"datePublished": "2026-11-15T01:49:36.388Z",
"dateReserved": "2026-11-15T01:02:25.540Z",
"dateUpdated": "2026-11-15T01:49:36.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129465 (GCVE-0-2026-129465)
Vulnerability from cvelistv5 – Published: 2026-11-15 01:49 – Updated: 2026-11-15 01:49
VLAI
EPSS
VEX
Title
Zr.Admin.NET commit af07ffc through eb9228a IDOR via /system/user/profile
Summary
Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vul.yulun.ac.cn/20261114/zr-admin-net/ | third-party-advisory |
| https://github.com/izhaorui/Zr.Admin.NET/issues/27 | issue-tracking |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/commit/a… | technical-descriptionpatch |
| https://www.vulncheck.com/advisories/zr-admin-net… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| izhaorui | Zr.Admin.NET |
Affected:
af07ffc5d18e7876d3780d1ff5ee776b80950399 , ≤ eb9228a23014f6000c06cab2f10ae0d44ecbbd3a
(git)
|
Date Public
2026-11-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"product": "Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET",
"vendor": "izhaorui",
"versions": [
{
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"version": "af07ffc5d18e7876d3780d1ff5ee776b80950399",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
}
],
"datePublic": "2026-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator\u0027s phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T01:49:35.675Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/SysProfileController.cs#L62-L75"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.ServiceCore/Services/SysUserService.cs#L220-L236"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/SysLoginController.cs#L516-L559"
},
{
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/commit/af07ffc5d18e7876d3780d1ff5ee776b80950399"
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit af07ffc through eb9228a IDOR via /system/user/profile",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-af07ffc-through-eb9228a-idor-via-system-user-profile"
}
],
"title": "Zr.Admin.NET commit af07ffc through eb9228a IDOR via /system/user/profile",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129465",
"datePublished": "2026-11-15T01:49:35.675Z",
"dateReserved": "2026-11-15T01:02:25.916Z",
"dateUpdated": "2026-11-15T01:49:35.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129466 (GCVE-0-2026-129466)
Vulnerability from cvelistv5 – Published: 2026-11-15 01:49 – Updated: 2026-11-15 01:49
VLAI
EPSS
VEX
Title
Zr.Admin.NET commit 1845017 through eb9228a Missing Authorization via /system/Tasks/get
Summary
Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vul.yulun.ac.cn/20261114/zr-admin-net/ | third-party-advisory |
| https://github.com/izhaorui/Zr.Admin.NET/issues/27 | issue-tracking |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://github.com/izhaorui/Zr.Admin.NET/blob/eb9… | technical-description |
| https://www.vulncheck.com/advisories/zr-admin-net… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| izhaorui | Zr.Admin.NET |
Affected:
1845017b67b3de3d12fad0238f5493235f70a93d , ≤ eb9228a23014f6000c06cab2f10ae0d44ecbbd3a
(git)
|
Date Public
2026-11-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/izhaorui/Zr.Admin.NET",
"product": "Zr.Admin.NET",
"repo": "https://github.com/izhaorui/Zr.Admin.NET",
"vendor": "izhaorui",
"versions": [
{
"lessThanOrEqual": "eb9228a23014f6000c06cab2f10ae0d44ecbbd3a",
"status": "affected",
"version": "1845017b67b3de3d12fad0238f5493235f70a93d",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
}
],
"datePublic": "2026-11-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-15T01:49:34.951Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://vul.yulun.ac.cn/20261114/zr-admin-net/"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/issues/27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksController.cs#L145-L157"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksController.cs#L84-L120"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksLogController.cs#L31-L46"
},
{
"name": "VulnCheck Advisory: Zr.Admin.NET commit 1845017 through eb9228a Missing Authorization via /system/Tasks/get",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zr-admin-net-commit-1845017-through-eb9228a-missing-authorization-via-system-tasks-get"
}
],
"title": "Zr.Admin.NET commit 1845017 through eb9228a Missing Authorization via /system/Tasks/get",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129466",
"datePublished": "2026-11-15T01:49:34.951Z",
"dateReserved": "2026-11-15T01:02:26.292Z",
"dateUpdated": "2026-11-15T01:49:34.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129447 (GCVE-0-2026-129447)
Vulnerability from cvelistv5 – Published: 2026-11-14 17:37 – Updated: 2026-11-14 17:37
VLAI
EPSS
VEX
Title
Kroki before 0.36.0 Reflected XSS via DBML Table URLs
Summary
Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/yuzutech/kroki/security/adviso… | vendor-advisory |
| https://github.com/yuzutech/kroki/commit/b57e1bdc… | patch |
| https://github.com/yuzutech/kroki/releases/tag/v0.36.0 | release-notes |
| https://github.com/yuzutech/kroki/blob/v0.35.0/db… | technical-description |
| https://www.vulncheck.com/advisories/kroki-before… | third-party-advisory |
Impacted products
Date Public
2026-11-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.kroki/kroki-server",
"product": "kroki",
"vendor": "yuzutech",
"versions": [
{
"lessThan": "0.36.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.36.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "oceanwarranty (Adgepuk Research)"
}
],
"datePublic": "2026-11-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T17:37:37.357Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fr36-wcx2-7gfq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/yuzutech/kroki/security/advisories/GHSA-fr36-wcx2-7gfq"
},
{
"tags": [
"patch"
],
"url": "https://github.com/yuzutech/kroki/commit/b57e1bdc39df9521b249db0dbd56c5e0a8b7e33d"
},
{
"name": "kroki v0.36.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/yuzutech/kroki/releases/tag/v0.36.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/yuzutech/kroki/blob/v0.35.0/dbml/index.js#L13"
},
{
"name": "VulnCheck Advisory: Kroki before 0.36.0 Reflected XSS via DBML Table URLs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kroki-before-0.36.0-reflected-xss-via-dbml-table-urls"
}
],
"title": "Kroki before 0.36.0 Reflected XSS via DBML Table URLs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129447",
"datePublished": "2026-11-14T17:37:37.357Z",
"dateReserved": "2026-11-14T17:15:36.981Z",
"dateUpdated": "2026-11-14T17:37:37.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71464 (GCVE-0-2025-71464)
Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
VLAI
EPSS
VEX
Title
@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()
Summary
@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/kolkov/angular-editor/issues/580 | issue-tracking |
| https://github.com/kolkov/angular-editor/pull/587 | issue-trackingpatch |
| https://github.com/kolkov/angular-editor/commit/1… | patch |
| https://github.com/kolkov/angular-editor/blob/a56… | technical-description |
| https://github.com/kolkov/angular-editor/releases… | release-notes |
| https://github.com/kolkov/angular-editor | product |
| https://www.vulncheck.com/advisories/kolkov-angul… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kolkov | angular-editor |
Affected:
0 , < 3.0.4
(semver)
Unaffected: 3.0.4 (semver) |
Date Public
2025-04-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40kolkov/angular-editor",
"product": "angular-editor",
"vendor": "kolkov",
"versions": [
{
"lessThan": "3.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.0.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mario Tesoro"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mario Tesoro"
}
],
"datePublic": "2025-04-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application\u0027s origin when toggling views."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T12:32:57.503Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #580",
"tags": [
"issue-tracking"
],
"url": "https://github.com/kolkov/angular-editor/issues/580"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/kolkov/angular-editor/pull/587"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e"
},
{
"name": "Unsanitized innerHTML in toggleEditorMode at v3.0.3",
"tags": [
"technical-description"
],
"url": "https://github.com/kolkov/angular-editor/blob/a56cc1672e29f058f1b28dba3f532b4040b56439/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L354-L361"
},
{
"name": "angular-editor v3.0.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/kolkov/angular-editor/releases/tag/v3.0.4"
},
{
"tags": [
"product"
],
"url": "https://github.com/kolkov/angular-editor"
},
{
"name": "VulnCheck Advisory: @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode"
}
],
"title": "@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71464",
"datePublished": "2026-11-14T12:32:57.503Z",
"dateReserved": "2026-11-14T12:15:39.710Z",
"dateUpdated": "2026-11-14T12:32:57.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71465 (GCVE-0-2025-71465)
Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
VLAI
EPSS
VEX
Title
@kolkov/angular-editor before 3.0.3 XSS via refreshView()
Summary
@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/kolkov/angular-editor/issues/580 | issue-tracking |
| https://github.com/kolkov/angular-editor/commit/7… | patch |
| https://github.com/kolkov/angular-editor/blob/a74… | technical-description |
| https://github.com/kolkov/angular-editor/releases… | release-notes |
| https://github.com/kolkov/angular-editor | product |
| https://www.vulncheck.com/advisories/kolkov-angul… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kolkov | angular-editor |
Affected:
0 , < 3.0.3
(semver)
Unaffected: 3.0.3 (semver) |
Date Public
2025-04-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40kolkov/angular-editor",
"product": "angular-editor",
"vendor": "kolkov",
"versions": [
{
"lessThan": "3.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.0.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mario Tesoro"
},
{
"lang": "en",
"type": "remediation developer",
"value": "kolkov"
}
],
"datePublic": "2025-04-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application\u0027s origin for users opening it."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T12:32:56.793Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #580",
"tags": [
"issue-tracking"
],
"url": "https://github.com/kolkov/angular-editor/issues/580"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/kolkov/angular-editor/commit/774a97d0b30e257a07c5d426548c9b900c8a8975"
},
{
"name": "Unsanitized innerHTML in refreshView at v3.0.2",
"tags": [
"technical-description"
],
"url": "https://github.com/kolkov/angular-editor/blob/a74a9b1900a0ecbfefbb701d7c272171101ff454/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L276-L278"
},
{
"name": "angular-editor v3.0.3 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/kolkov/angular-editor/releases/tag/v3.0.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/kolkov/angular-editor"
},
{
"name": "VulnCheck Advisory: @kolkov/angular-editor before 3.0.3 XSS via refreshView()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.3-xss-via-refreshview"
}
],
"title": "@kolkov/angular-editor before 3.0.3 XSS via refreshView()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71465",
"datePublished": "2026-11-14T12:32:56.793Z",
"dateReserved": "2026-11-14T12:15:40.062Z",
"dateUpdated": "2026-11-14T12:32:56.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129428 (GCVE-0-2026-129428)
Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
VLAI
EPSS
VEX
Title
Pulse 5.0.17 before 6.8.0 Missing Authorization via AI Assistant Approval API
Summary
Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose proposed commands and targets, and approve or deny other users' requests, altering decision and audit state.
Severity
5.4 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rcourtman/Pulse/security/advis… | vendor-advisory |
| https://github.com/rcourtman/Pulse/pull/4127 | issue-trackingpatch |
| https://github.com/rcourtman/Pulse/commit/f05119d… | patch |
| https://github.com/rcourtman/Pulse/blob/v6.7.0/in… | technical-description |
| https://github.com/rcourtman/Pulse/releases/tag/v6.8.0 | release-notes |
| https://github.com/rcourtman/Pulse | product |
| https://www.vulncheck.com/advisories/pulse-5.0.17… | third-party-advisory |
Impacted products
Date Public
2026-11-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/rcourtman/pulse-go-rewrite",
"product": "Pulse",
"vendor": "rcourtman",
"versions": [
{
"lessThan": "6.8.0",
"status": "affected",
"version": "5.0.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "naroSEC"
},
{
"lang": "en",
"type": "remediation developer",
"value": "rcourtman"
}
],
"datePublic": "2026-11-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose proposed commands and targets, and approve or deny other users\u0027 requests, altering decision and audit state."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T12:32:56.082Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9vxw-m79f-gxxr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rcourtman/Pulse/security/advisories/GHSA-9vxw-m79f-gxxr"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/rcourtman/Pulse/pull/4127"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/rcourtman/Pulse/commit/f05119d97ea3bc1980886d8c62dda7ce8fd39d4e"
},
{
"name": "Approve handler without role check at v6.7.0",
"tags": [
"technical-description"
],
"url": "https://github.com/rcourtman/Pulse/blob/v6.7.0/internal/api/ai_handlers.go#L7686"
},
{
"name": "Pulse v6.8.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/rcourtman/Pulse/releases/tag/v6.8.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/rcourtman/Pulse"
},
{
"name": "VulnCheck Advisory: Pulse 5.0.17 before 6.8.0 Missing Authorization via AI Assistant Approval API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pulse-5.0.17-before-6.8.0-missing-authorization-via-ai-assistant-approval-api"
}
],
"title": "Pulse 5.0.17 before 6.8.0 Missing Authorization via AI Assistant Approval API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129428",
"datePublished": "2026-11-14T12:32:56.082Z",
"dateReserved": "2026-11-14T12:15:37.839Z",
"dateUpdated": "2026-11-14T12:32:56.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129429 (GCVE-0-2026-129429)
Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
VLAI
EPSS
VEX
Title
Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector
Summary
Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/india-payroll/security/… | vendor-advisory |
| https://github.com/frappe/india-payroll/commit/78… | patch |
| https://github.com/frappe/india-payroll/commit/bd… | patch |
| https://github.com/frappe/india-payroll/blob/9c1f… | technical-description |
| https://github.com/frappe/india-payroll/releases/… | release-notes |
| https://github.com/frappe/india-payroll | product |
| https://www.vulncheck.com/advisories/frappe-india… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| frappe | india-payroll |
Affected:
0 , < 16.0.4
(semver)
Unaffected: 16.0.4 (semver) |
Date Public
2026-09-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/india-payroll",
"product": "india-payroll",
"vendor": "frappe",
"versions": [
{
"lessThan": "16.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.0.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Darshan U"
},
{
"lang": "en",
"type": "remediation developer",
"value": "asmitahase"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other employees\u0027 payroll data. Attackers can supply another employee identifier to read base pay and earning and deduction components, or change the tax regime on draft Salary Structure Assignments to affect tax withholding."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T12:32:55.388Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-758f-34xj-xvcc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/india-payroll/security/advisories/GHSA-758f-34xj-xvcc"
},
{
"name": "Patch Commit (develop)",
"tags": [
"patch"
],
"url": "https://github.com/frappe/india-payroll/commit/78de736298a340ecb971826a5df10e7204773cef"
},
{
"name": "Patch Commit (v16.0.4)",
"tags": [
"patch"
],
"url": "https://github.com/frappe/india-payroll/commit/bdb988f172663db4054f9c3fc23833f10c3b60b0"
},
{
"name": "set_tax_regime without permission check at v16.0.3",
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/india-payroll/blob/9c1fc91b34de8a55df58aa5f2dbabff95dedb4d1/india_payroll/india_payroll/page/tax_regime_selector/tax_regime_selector.py#L207-L215"
},
{
"name": "india-payroll v16.0.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/frappe/india-payroll/releases/tag/v16.0.4"
},
{
"tags": [
"product"
],
"url": "https://github.com/frappe/india-payroll"
},
{
"name": "VulnCheck Advisory: Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-india-payroll-before-16.0.4-missing-authorization-via-tax-regime-selector"
}
],
"title": "Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129429",
"datePublished": "2026-11-14T12:32:55.388Z",
"dateReserved": "2026-11-14T12:15:38.215Z",
"dateUpdated": "2026-11-14T12:32:55.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129430 (GCVE-0-2026-129430)
Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
VLAI
EPSS
VEX
Title
axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links
Summary
Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/axeloz/filesharing/commit/eebc… | patch |
| https://github.com/axeloz/filesharing/commit/366e… | patch |
| https://github.com/axeloz/filesharing/pull/90 | issue-trackingpatch |
| https://github.com/axeloz/filesharing/blob/e865be… | technical-description |
| https://github.com/axeloz/filesharing/releases/ta… | release-notes |
| https://github.com/axeloz/filesharing | product |
| https://www.vulncheck.com/advisories/axeloz-files… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| axeloz | filesharing |
Affected:
0 , < 2.14.3
(semver)
Unaffected: 2.14.3 (semver) |
Date Public
2026-11-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/axeloz/filesharing",
"product": "filesharing",
"vendor": "axeloz",
"versions": [
{
"lessThan": "2.14.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.14.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Raqin Al-Asraar"
},
{
"lang": "en",
"type": "remediation developer",
"value": "axeloz"
}
],
"datePublic": "2026-11-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle preview page execute the script via Alpine x-html, letting attackers steal the owner_token from localStorage and issue owner-scoped requests against victim bundles."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T12:32:54.682Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/axeloz/filesharing/commit/eebc80a77c0e3fe3b8467245ba89fa49f2d35928"
},
{
"name": "Patch Commit (BundleResourceFiltered)",
"tags": [
"patch"
],
"url": "https://github.com/axeloz/filesharing/commit/366ee452aba636858d55b82068ecc35f6d08b6d6"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/axeloz/filesharing/pull/90"
},
{
"name": "Unsafe Str::markdown rendering of description",
"tags": [
"technical-description"
],
"url": "https://github.com/axeloz/filesharing/blob/e865be1f09f8eb5a46c4b9a16635de892b093d8f/app/Http/Resources/BundleResource.php#L33"
},
{
"name": "filesharing 2.14.3 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/axeloz/filesharing/releases/tag/2.14.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/axeloz/filesharing"
},
{
"name": "VulnCheck Advisory: axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/axeloz-filesharing-before-2.14.3-stored-xss-via-bundle-description-markdown-links"
}
],
"title": "axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129430",
"datePublished": "2026-11-14T12:32:54.682Z",
"dateReserved": "2026-11-14T12:15:38.594Z",
"dateUpdated": "2026-11-14T12:32:54.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129431 (GCVE-0-2026-129431)
Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
VLAI
EPSS
VEX
Title
Ettercap through 0.8.5.1 Heap Out-of-Bounds Read via SOCKS5 Dissector
Summary
Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c that allows network-adjacent attackers to read heap memory via unchecked SOCKS5 username/password lengths. Attackers can send a crafted SOCKS5 authentication packet observed by Ettercap to read up to 255 bytes past the heap buffer, disclosing memory printed and logged as captured credentials.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Ettercap/ettercap/pull/1340 | issue-trackingpatch |
| https://github.com/Ettercap/ettercap/blob/v0.8.5.… | technical-description |
| https://github.com/Ettercap/ettercap | product |
| https://www.vulncheck.com/advisories/ettercap-thr… | third-party-advisory |
Impacted products
Date Public
2026-11-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Ettercap/ettercap",
"product": "ettercap",
"vendor": "Ettercap",
"versions": [
{
"lessThanOrEqual": "0.8.5.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ettercap-project:ettercap:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.8.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "stilwel"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Emilio Escobar"
}
],
"datePublic": "2026-11-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c that allows network-adjacent attackers to read heap memory via unchecked SOCKS5 username/password lengths. Attackers can send a crafted SOCKS5 authentication packet observed by Ettercap to read up to 255 bytes past the heap buffer, disclosing memory printed and logged as captured credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T12:32:53.988Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #1340",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Ettercap/ettercap/pull/1340"
},
{
"name": "Unchecked SOCKS5 credential copy at v0.8.5.1",
"tags": [
"technical-description"
],
"url": "https://github.com/Ettercap/ettercap/blob/v0.8.5.1/src/dissectors/ec_socks.c#L108-L124"
},
{
"tags": [
"product"
],
"url": "https://github.com/Ettercap/ettercap"
},
{
"name": "VulnCheck Advisory: Ettercap through 0.8.5.1 Heap Out-of-Bounds Read via SOCKS5 Dissector",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ettercap-through-0.8.5.1-heap-out-of-bounds-read-via-socks5-dissector"
}
],
"title": "Ettercap through 0.8.5.1 Heap Out-of-Bounds Read via SOCKS5 Dissector",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129431",
"datePublished": "2026-11-14T12:32:53.988Z",
"dateReserved": "2026-11-14T12:15:38.957Z",
"dateUpdated": "2026-11-14T12:32:53.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129432 (GCVE-0-2026-129432)
Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
VLAI
EPSS
VEX
Title
Ettercap through 0.8.5.1 Heap Out-of-Bounds Read in NFS mountd Dissector
Summary
Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in src/dissectors/ec_mountd.c that validates RPC credential and directory lengths independently rather than against the packet end. Network-adjacent attackers can send a crafted MOUNT MNT call to read up to 100 bytes past the heap buffer, leaking memory to the console and logs.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Ettercap/ettercap/pull/1341 | issue-trackingpatch |
| https://github.com/Ettercap/ettercap/blob/v0.8.5.… | technical-description |
| https://github.com/Ettercap/ettercap | product |
| https://www.vulncheck.com/advisories/ettercap-thr… | third-party-advisory |
Impacted products
Date Public
2026-11-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Ettercap/ettercap",
"product": "ettercap",
"vendor": "Ettercap",
"versions": [
{
"lessThanOrEqual": "0.8.5.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ettercap-project:ettercap:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.8.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "stilwel"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Emilio Escobar"
}
],
"datePublic": "2026-11-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in src/dissectors/ec_mountd.c that validates RPC credential and directory lengths independently rather than against the packet end. Network-adjacent attackers can send a crafted MOUNT MNT call to read up to 100 bytes past the heap buffer, leaking memory to the console and logs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T12:32:53.320Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #1341",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Ettercap/ettercap/pull/1341"
},
{
"name": "Unchecked mountd directory copy at v0.8.5.1",
"tags": [
"technical-description"
],
"url": "https://github.com/Ettercap/ettercap/blob/v0.8.5.1/src/dissectors/ec_mountd.c#L88-L103"
},
{
"tags": [
"product"
],
"url": "https://github.com/Ettercap/ettercap"
},
{
"name": "VulnCheck Advisory: Ettercap through 0.8.5.1 Heap Out-of-Bounds Read in NFS mountd Dissector",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ettercap-through-0.8.5.1-heap-out-of-bounds-read-in-nfs-mountd-dissector"
}
],
"title": "Ettercap through 0.8.5.1 Heap Out-of-Bounds Read in NFS mountd Dissector",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129432",
"datePublished": "2026-11-14T12:32:53.320Z",
"dateReserved": "2026-11-14T12:15:39.336Z",
"dateUpdated": "2026-11-14T12:32:53.320Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}