Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-92196 (GCVE-0-2026-92196)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 18:53

Title

Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the renderTemplateString method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29889.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:53 UTC

CWE

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92196",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:53:14.038912Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:53:26.385Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:12:11.676Z",
      "datePublic": "2026-11-03T21:57:02.027Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the renderTemplateString method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29889."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:57.820Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-866",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-866/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92196",
    "datePublished": "2026-11-03T23:51:57.820Z",
    "dateReserved": "2026-09-15T18:12:11.639Z",
    "dateUpdated": "2026-11-06T18:53:26.385Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92200 (GCVE-0-2026-92200)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:00

Title

Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability

Summary

Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:00 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92200",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:00:28.914037Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:00:40.371Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:12:27.310Z",
      "datePublic": "2026-11-03T21:56:58.993Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the product installer. The issue results from incorrect permissions on a folder used by the product. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31118."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:53.372Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-865",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-865/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bobby Gould (@bobbygould5) of TrendAI Zero Day Initiative"
      },
      "title": "Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92200",
    "datePublished": "2026-11-03T23:51:53.372Z",
    "dateReserved": "2026-09-15T18:12:27.276Z",
    "dateUpdated": "2026-11-06T19:00:40.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92198 (GCVE-0-2026-92198)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:01

Title

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability

Summary

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getSource method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29934.

Severity

8.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:01 UTC

CWE

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92198",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:01:03.562082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:01:16.761Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:12:19.679Z",
      "datePublic": "2026-11-03T21:56:55.632Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the getSource method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29934."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:49.757Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-864",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-864/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92198",
    "datePublished": "2026-11-03T23:51:49.757Z",
    "dateReserved": "2026-09-15T18:12:19.643Z",
    "dateUpdated": "2026-11-06T19:01:16.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92199 (GCVE-0-2026-92199)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:01

Title

Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability

Summary

Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:01 UTC

CWE

CWE-321 - Use of Hard-coded Cryptographic Key

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92199",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:01:31.568027Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:01:41.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:12:23.127Z",
      "datePublic": "2026-11-03T21:56:52.793Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the symmetricDecrypt method. The issue results from the use of a hard-coded cryptographic key. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-29967."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321: Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:45.350Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-863",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-863/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92199",
    "datePublished": "2026-11-03T23:51:45.350Z",
    "dateReserved": "2026-09-15T18:12:23.094Z",
    "dateUpdated": "2026-11-06T19:01:41.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92185 (GCVE-0-2026-92185)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:02

Title

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability

Summary

Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AbstractParser class. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-28929.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:01 UTC

CWE

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92185",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:01:57.812157Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:02:08.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:30.262Z",
      "datePublic": "2026-11-03T21:56:49.860Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the AbstractParser class. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-28929."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:31.399Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-862",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-862/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92185",
    "datePublished": "2026-11-03T23:51:31.399Z",
    "dateReserved": "2026-09-15T18:11:30.230Z",
    "dateUpdated": "2026-11-06T19:02:08.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92189 (GCVE-0-2026-92189)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:02

Title

Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the writeTopologySectionToFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29169.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:02 UTC

CWE

CWE-73 - External Control of File Name or Path

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92189",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:02:27.364429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:02:37.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:44.991Z",
      "datePublic": "2026-11-03T21:56:47.183Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the writeTopologySectionToFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29169."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:27.372Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-861",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-861/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92189",
    "datePublished": "2026-11-03T23:51:27.372Z",
    "dateReserved": "2026-09-15T18:11:44.959Z",
    "dateUpdated": "2026-11-06T19:02:37.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92197 (GCVE-0-2026-92197)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:00

Title

Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29901.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:59 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92197",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:59:54.971417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:00:08.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:12:16.234Z",
      "datePublic": "2026-11-03T21:56:44.270Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29901."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:23.789Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-860",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-860/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92197",
    "datePublished": "2026-11-03T23:51:23.789Z",
    "dateReserved": "2026-09-15T18:12:16.201Z",
    "dateUpdated": "2026-11-06T19:00:08.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92191 (GCVE-0-2026-92191)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:05

Title

Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the runScript function. The issue results from incorrect authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29192.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:05 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:05:33.642554Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:05:45.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:51.488Z",
      "datePublic": "2026-11-03T21:56:41.475Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the runScript function. The issue results from incorrect authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29192."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:20.139Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-859",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-859/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92191",
    "datePublished": "2026-11-03T23:51:20.139Z",
    "dateReserved": "2026-09-15T18:11:51.455Z",
    "dateUpdated": "2026-11-06T19:05:45.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92186 (GCVE-0-2026-92186)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:05

Title

Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the paFnUploadFileAndCreateInfo script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29038.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:05 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:05:05.798637Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:05:17.130Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:33.072Z",
      "datePublic": "2026-11-03T21:56:38.250Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the paFnUploadFileAndCreateInfo script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29038."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:15.508Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-858",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-858/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92186",
    "datePublished": "2026-11-03T23:51:15.508Z",
    "dateReserved": "2026-09-15T18:11:33.035Z",
    "dateUpdated": "2026-11-06T19:05:17.130Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92194 (GCVE-0-2026-92194)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:04

Title

Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadManageServerLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29231.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:04 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92194",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:04:35.662107Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:04:48.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:12:02.891Z",
      "datePublic": "2026-11-03T21:56:34.985Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the loadManageServerLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29231."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:11.189Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-857",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-857/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92194",
    "datePublished": "2026-11-03T23:51:11.189Z",
    "dateReserved": "2026-09-15T18:12:02.858Z",
    "dateUpdated": "2026-11-06T19:04:48.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92195 (GCVE-0-2026-92195)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:03

Title

Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the loadEvolveLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29232.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:03 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92195",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:03:03.728557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:03:17.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:12:06.523Z",
      "datePublic": "2026-11-03T21:56:31.633Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the loadEvolveLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29232."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:05.789Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-856",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-856/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92195",
    "datePublished": "2026-11-03T23:51:05.789Z",
    "dateReserved": "2026-09-15T18:12:06.482Z",
    "dateUpdated": "2026-11-06T19:03:17.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92192 (GCVE-0-2026-92192)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:51 – Updated: 2026-11-06 19:04

Title

Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the installLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29215.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:04 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92192",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:04:07.026554Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:04:17.455Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:54.997Z",
      "datePublic": "2026-11-03T21:56:28.312Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the installLicense script. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29215."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:51:01.973Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-855",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-855/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92192",
    "datePublished": "2026-11-03T23:51:01.973Z",
    "dateReserved": "2026-09-15T18:11:54.965Z",
    "dateUpdated": "2026-11-06T19:04:17.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92188 (GCVE-0-2026-92188)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:50 – Updated: 2026-11-06 19:03

Title

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ForgeMBeanServerSupport module. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29168.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 19:03 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92188",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:03:35.998460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:03:49.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:41.585Z",
      "datePublic": "2026-11-03T21:56:25.764Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the ForgeMBeanServerSupport module. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29168."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:50:58.353Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-854",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-854/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92188",
    "datePublished": "2026-11-03T23:50:58.353Z",
    "dateReserved": "2026-09-15T18:11:41.548Z",
    "dateUpdated": "2026-11-06T19:03:49.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92193 (GCVE-0-2026-92193)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:50 – Updated: 2026-11-06 18:55

Title

Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability

Summary

Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileServlet class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-29216.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:55 UTC

CWE

CWE-73 - External Control of File Name or Path

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92193",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:55:29.878009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:55:41.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:58.428Z",
      "datePublic": "2026-11-03T21:56:23.004Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the FileServlet class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-29216."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:50:55.236Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-853",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-853/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92193",
    "datePublished": "2026-11-03T23:50:55.236Z",
    "dateReserved": "2026-09-15T18:11:58.395Z",
    "dateUpdated": "2026-11-06T18:55:41.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92187 (GCVE-0-2026-92187)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:50 – Updated: 2026-11-06 18:58

Title

Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the extractAndCreateUploadInfoList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29039.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:58 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92187",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:58:15.753536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:58:27.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:36.998Z",
      "datePublic": "2026-11-03T21:56:20.102Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the extractAndCreateUploadInfoList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29039."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:50:52.021Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-852",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-852/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92187",
    "datePublished": "2026-11-03T23:50:52.021Z",
    "dateReserved": "2026-09-15T18:11:36.966Z",
    "dateUpdated": "2026-11-06T18:58:27.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92190 (GCVE-0-2026-92190)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:50 – Updated: 2026-11-06 18:57

Title

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability

Summary

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results from the lack of proper validation of user-supplied data prior to deserializing it. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29170.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:57 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Quest	Foglight for Databases	Affected: 8.2.0

Date Public

2026-11-03 21:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92190",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:57:47.834597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:57:58.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Foglight for Databases",
          "vendor": "Quest",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:11:48.108Z",
      "datePublic": "2026-11-03T21:56:16.938Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results from the lack of proper validation of user-supplied data prior to deserializing it. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29170."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:50:48.578Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-851",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-851/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
      },
      "title": "Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92190",
    "datePublished": "2026-11-03T23:50:48.578Z",
    "dateReserved": "2026-09-15T18:11:48.076Z",
    "dateUpdated": "2026-11-06T18:57:58.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92211 (GCVE-0-2026-92211)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:49 – Updated: 2026-11-06 18:57

Title

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability

Summary

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:56 UTC

CWE

CWE-415 - Double Free

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

2 references

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory
https://github.com/PixarAnimationStudios/OpenUSD/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Pixar Animation Studio	OpenUSD	Affected: v26.03

Date Public

2026-10-26 19:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92211",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:56:55.251051Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:57:17.737Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenUSD",
          "vendor": "Pixar Animation Studio",
          "versions": [
            {
              "status": "affected",
              "version": "v26.03"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-15T18:18:18.400Z",
      "datePublic": "2026-10-26T19:15:05.552Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415: Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:49:08.403Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-791",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-791/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/PixarAnimationStudios/OpenUSD/commit/7c62a43d8823dd4e1ef8c49fc1d72729e1ce6e36"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Brandon Evans of TrendAI Zero Day Initiative"
      },
      "title": "Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-92211",
    "datePublished": "2026-11-03T23:49:08.403Z",
    "dateReserved": "2026-09-15T18:18:18.366Z",
    "dateUpdated": "2026-11-06T18:57:17.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114552 (GCVE-0-2026-114552)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:47 – Updated: 2026-11-06 18:56

Title

MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability

Summary

MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the parseObjectResponse method. The issue results from the lack of proper restriction of XML External Entity (XXE) references. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-29137.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:56 UTC

CWE

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
MailEnable	MailEnable	Affected: 10.59

Date Public

2026-10-27 20:37

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114552",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:56:26.843216Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:56:39.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "MailEnable",
          "vendor": "MailEnable",
          "versions": [
            {
              "status": "affected",
              "version": "10.59"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-21T17:11:51.308Z",
      "datePublic": "2026-10-27T20:37:04.394Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the parseObjectResponse method. The issue results from the lack of proper restriction of XML External Entity (XXE) references. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-29137."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:47:50.012Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-811",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-811/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Nicolas Chatelain"
      },
      "title": "MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-114552",
    "datePublished": "2026-11-03T23:47:50.012Z",
    "dateReserved": "2026-10-21T17:11:51.280Z",
    "dateUpdated": "2026-11-06T18:56:39.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114551 (GCVE-0-2026-114551)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:47 – Updated: 2026-11-06 18:56

Title

MailEnable Auth Cleartext Storage Information Disclosure Vulnerability

Summary

MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of mailbox credentials. The issue results from storing sensitive information in plaintext. An attacker can leverage this in conjunction with other vulnerabilities to disclose stored credentials, leading to further compromise. Was ZDI-CAN-34478.

Severity

5.9 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:56 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
MailEnable	MailEnable	Affected: 10.59

Date Public

2026-10-27 20:36

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:56:00.847788Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:56:12.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "MailEnable",
          "vendor": "MailEnable",
          "versions": [
            {
              "status": "affected",
              "version": "10.59"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-21T17:11:41.954Z",
      "datePublic": "2026-10-27T20:36:55.300Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of mailbox credentials. The issue results from storing sensitive information in plaintext. An attacker can leverage this in conjunction with other vulnerabilities to disclose stored credentials, leading to further compromise. Was ZDI-CAN-34478."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312: Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:47:41.100Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-810",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-810/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Nicolas Chatelain"
      },
      "title": "MailEnable Auth Cleartext Storage Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-114551",
    "datePublished": "2026-11-03T23:47:41.100Z",
    "dateReserved": "2026-10-21T17:11:41.926Z",
    "dateUpdated": "2026-11-06T18:56:12.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114550 (GCVE-0-2026-114550)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:47 – Updated: 2026-11-06 18:55

Title

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

Summary

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.

Severity

8.1 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:54 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

2 references

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory
https://github.com/warmcat/libwebsockets/commit/c…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
libwebsockets	libwebsockets	Affected: b4b5aed3903eaff09cd76a410f69bbe5dff66f8e

Date Public

2026-10-26 19:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114550",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:54:55.995464Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:55:07.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "libwebsockets",
          "vendor": "libwebsockets",
          "versions": [
            {
              "status": "affected",
              "version": "b4b5aed3903eaff09cd76a410f69bbe5dff66f8e"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-21T17:10:09.253Z",
      "datePublic": "2026-10-26T19:15:14.778Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:47:02.249Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-792",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-792/"
        },
        {
          "name": "vendor-provided URL",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/warmcat/libwebsockets/commit/c9e8e1834d7f13038c82963086b90e2ee9c5b44c"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-114550",
    "datePublished": "2026-11-03T23:47:02.249Z",
    "dateReserved": "2026-10-21T17:10:09.224Z",
    "dateUpdated": "2026-11-06T18:55:07.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114549 (GCVE-0-2026-114549)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:46 – Updated: 2026-11-06 18:54

Title

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability

Summary

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:54 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
NoMachine	NoMachine	Affected: 9.7.3

Date Public

2026-10-23 01:47

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114549",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:54:22.382693Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:54:33.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "NoMachine",
          "vendor": "NoMachine",
          "versions": [
            {
              "status": "affected",
              "version": "9.7.3"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-21T17:09:37.608Z",
      "datePublic": "2026-10-23T01:47:05.259Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:46:39.428Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-786",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-786/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Sajeeb Lohani"
      },
      "title": "NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-114549",
    "datePublished": "2026-11-03T23:46:39.428Z",
    "dateReserved": "2026-10-21T17:09:37.496Z",
    "dateUpdated": "2026-11-06T18:54:33.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118628 (GCVE-0-2026-118628)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:46 – Updated: 2026-11-06 18:54

Title

MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability

Summary

MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192.

Severity

8.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 18:53 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
MLflow	MLflow	Affected: 3.8.0

Date Public

2026-10-29 19:05

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118628",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T18:53:52.092858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T18:54:02.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "MLflow",
          "vendor": "MLflow",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:57:05.610Z",
      "datePublic": "2026-10-29T19:05:29.302Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:46:07.128Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-844",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-844/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Muhammad Fadilullah Dzaki"
      },
      "title": "MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118628",
    "datePublished": "2026-11-03T23:46:07.128Z",
    "dateReserved": "2026-10-28T16:57:05.584Z",
    "dateUpdated": "2026-11-06T18:54:02.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118627 (GCVE-0-2026-118627)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:45 – Updated: 2026-11-05 04:55

Title

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

Summary

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 00:00 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
MLflow	MLflow	Affected: 3.11.2.dev0

Date Public

2026-10-29 19:05

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118627",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T04:55:59.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "MLflow",
          "vendor": "MLflow",
          "versions": [
            {
              "status": "affected",
              "version": "3.11.2.dev0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:57:01.676Z",
      "datePublic": "2026-10-29T19:05:22.981Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the loading of SHAP explainer models. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30301."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:45:58.808Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-843",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-843/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Ben Koo (@kiddo_pwn)"
      },
      "title": "MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118627",
    "datePublished": "2026-11-03T23:45:58.808Z",
    "dateReserved": "2026-10-28T16:57:01.649Z",
    "dateUpdated": "2026-11-05T04:55:59.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118626 (GCVE-0-2026-118626)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:45 – Updated: 2026-11-05 04:55

Title

MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability

Summary

MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of the BEFORE_REQUEST_HANDLERS. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32108.

Severity

5.4 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 00:00 UTC

CWE

CWE-862 - Missing Authorization

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
MLflow	MLflow	Affected: 3.14.0

Date Public

2026-10-29 19:05

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118626",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T04:55:58.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "MLflow",
          "vendor": "MLflow",
          "versions": [
            {
              "status": "affected",
              "version": "3.14.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:56:57.408Z",
      "datePublic": "2026-10-29T19:05:14.961Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of the BEFORE_REQUEST_HANDLERS. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32108."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:45:50.030Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-842",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-842/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Grigory Dorodnov of TrendAI Research"
      },
      "title": "MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118626",
    "datePublished": "2026-11-03T23:45:50.030Z",
    "dateReserved": "2026-10-28T16:56:57.381Z",
    "dateUpdated": "2026-11-05T04:55:58.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118625 (GCVE-0-2026-118625)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:45 – Updated: 2026-11-05 04:55

Title

MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability

Summary

MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the get_endpoints function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32107.

Severity

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 00:00 UTC

CWE

CWE-862 - Missing Authorization

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
MLflow	MLflow	Affected: 3.14.0

Date Public

2026-10-29 19:05

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118625",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T04:55:58.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "MLflow",
          "vendor": "MLflow",
          "versions": [
            {
              "status": "affected",
              "version": "3.14.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:56:54.166Z",
      "datePublic": "2026-10-29T19:05:06.403Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the get_endpoints function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32107."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:45:41.744Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-841",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-841/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Grigory Dorodnov of TrendAI Research"
      },
      "title": "MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118625",
    "datePublished": "2026-11-03T23:45:41.744Z",
    "dateReserved": "2026-10-28T16:56:54.139Z",
    "dateUpdated": "2026-11-05T04:55:58.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118624 (GCVE-0-2026-118624)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:45 – Updated: 2026-11-04 15:18

Title

MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability

Summary

MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894.

Severity

5.4 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 14:59 UTC

CWE

CWE-862 - Missing Authorization

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
MLflow	MLflow	Affected: 3.13.0

Date Public

2026-10-29 19:04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T14:59:32.799301Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T15:18:58.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "MLflow",
          "vendor": "MLflow",
          "versions": [
            {
              "status": "affected",
              "version": "3.13.0"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:56:50.859Z",
      "datePublic": "2026-10-29T19:04:59.148Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:45:30.988Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-840",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-840/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Grigory Dorodnov of TrendAI Research"
      },
      "title": "MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118624",
    "datePublished": "2026-11-03T23:45:30.988Z",
    "dateReserved": "2026-10-28T16:56:50.833Z",
    "dateUpdated": "2026-11-04T15:18:58.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118623 (GCVE-0-2026-118623)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:45 – Updated: 2026-11-05 04:55

Title

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

Summary

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 00:00 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
MLflow	MLflow	Affected: 3.10.1

Date Public

2026-10-29 19:04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118623",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T04:55:57.412Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "MLflow",
          "vendor": "MLflow",
          "versions": [
            {
              "status": "affected",
              "version": "3.10.1"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:56:47.059Z",
      "datePublic": "2026-10-29T19:04:53.016Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:45:23.490Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-839",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-839/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118623",
    "datePublished": "2026-11-03T23:45:23.490Z",
    "dateReserved": "2026-10-28T16:56:47.034Z",
    "dateUpdated": "2026-11-05T04:55:57.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118619 (GCVE-0-2026-118619)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-11-05 17:05

Title

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability

Summary

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 17:04 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.103

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T17:04:28.934669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T17:05:13.542Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.103"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:46.820Z",
      "datePublic": "2026-10-28T16:31:36.742Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:34.850Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-818",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-818/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118619",
    "datePublished": "2026-10-28T16:54:34.850Z",
    "dateReserved": "2026-10-28T16:53:46.779Z",
    "dateUpdated": "2026-11-05T17:05:13.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118618 (GCVE-0-2026-118618)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-11-05 17:07

Title

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

Summary

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 17:07 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118618",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T17:07:03.114728Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T17:07:19.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:42.340Z",
      "datePublic": "2026-10-28T16:31:30.095Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parse_model function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30121."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:29.943Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-817",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-817/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics parse_model Code Injection Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118618",
    "datePublished": "2026-10-28T16:54:29.943Z",
    "dateReserved": "2026-10-28T16:53:42.313Z",
    "dateUpdated": "2026-11-05T17:07:19.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118617 (GCVE-0-2026-118617)

Vulnerability from cvelistv5 – Published: 2026-10-28 16:54 – Updated: 2026-11-05 17:07

Title

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

Summary

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 17:07 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

zdi CNA under the mitre root

CNA scorecard C 72/100 over 166 records in the last 180 days details

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
Ultralytics	Ultralytics	Affected: 8.4.65

Date Public

2026-10-28 16:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118617",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T17:07:39.842583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T17:07:57.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Ultralytics",
          "vendor": "Ultralytics",
          "versions": [
            {
              "status": "affected",
              "version": "8.4.65"
            }
          ]
        }
      ],
      "dateAssigned": "2026-10-28T16:53:38.959Z",
      "datePublic": "2026-10-28T16:31:25.393Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T16:54:24.766Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-26-816",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-816/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Bongeun Koo (@kiddo_pwn)"
      },
      "title": "Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2026-118617",
    "datePublished": "2026-10-28T16:54:24.766Z",
    "dateReserved": "2026-10-28T16:53:38.934Z",
    "dateUpdated": "2026-11-05T17:07:57.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

3490 vulnerabilities

CVE-2026-92196 (GCVE-0-2026-92196)

CVE-2026-92200 (GCVE-0-2026-92200)

CVE-2026-92198 (GCVE-0-2026-92198)

CVE-2026-92199 (GCVE-0-2026-92199)

CVE-2026-92185 (GCVE-0-2026-92185)

CVE-2026-92189 (GCVE-0-2026-92189)

CVE-2026-92197 (GCVE-0-2026-92197)

CVE-2026-92191 (GCVE-0-2026-92191)

CVE-2026-92186 (GCVE-0-2026-92186)

CVE-2026-92194 (GCVE-0-2026-92194)

CVE-2026-92195 (GCVE-0-2026-92195)

CVE-2026-92192 (GCVE-0-2026-92192)

CVE-2026-92188 (GCVE-0-2026-92188)

CVE-2026-92193 (GCVE-0-2026-92193)

CVE-2026-92187 (GCVE-0-2026-92187)

CVE-2026-92190 (GCVE-0-2026-92190)

CVE-2026-92211 (GCVE-0-2026-92211)

CVE-2026-114552 (GCVE-0-2026-114552)

CVE-2026-114551 (GCVE-0-2026-114551)

CVE-2026-114550 (GCVE-0-2026-114550)

CVE-2026-114549 (GCVE-0-2026-114549)

CVE-2026-118628 (GCVE-0-2026-118628)

CVE-2026-118627 (GCVE-0-2026-118627)

CVE-2026-118626 (GCVE-0-2026-118626)

CVE-2026-118625 (GCVE-0-2026-118625)

CVE-2026-118624 (GCVE-0-2026-118624)

CVE-2026-118623 (GCVE-0-2026-118623)

CVE-2026-118619 (GCVE-0-2026-118619)

CVE-2026-118618 (GCVE-0-2026-118618)

CVE-2026-118617 (GCVE-0-2026-118617)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

3490 vulnerabilities

CVE-2026-92196 (GCVE-0-2026-92196)

CVE-2026-92200 (GCVE-0-2026-92200)

CVE-2026-92198 (GCVE-0-2026-92198)

CVE-2026-92199 (GCVE-0-2026-92199)

CVE-2026-92185 (GCVE-0-2026-92185)

CVE-2026-92189 (GCVE-0-2026-92189)

CVE-2026-92197 (GCVE-0-2026-92197)

CVE-2026-92191 (GCVE-0-2026-92191)

CVE-2026-92186 (GCVE-0-2026-92186)

CVE-2026-92194 (GCVE-0-2026-92194)

CVE-2026-92195 (GCVE-0-2026-92195)

CVE-2026-92192 (GCVE-0-2026-92192)

CVE-2026-92188 (GCVE-0-2026-92188)

CVE-2026-92193 (GCVE-0-2026-92193)

CVE-2026-92187 (GCVE-0-2026-92187)

CVE-2026-92190 (GCVE-0-2026-92190)

CVE-2026-92211 (GCVE-0-2026-92211)

CVE-2026-114552 (GCVE-0-2026-114552)

CVE-2026-114551 (GCVE-0-2026-114551)

CVE-2026-114550 (GCVE-0-2026-114550)

CVE-2026-114549 (GCVE-0-2026-114549)

CVE-2026-118628 (GCVE-0-2026-118628)

CVE-2026-118627 (GCVE-0-2026-118627)

CVE-2026-118626 (GCVE-0-2026-118626)

CVE-2026-118625 (GCVE-0-2026-118625)

CVE-2026-118624 (GCVE-0-2026-118624)

CVE-2026-118623 (GCVE-0-2026-118623)

CVE-2026-118619 (GCVE-0-2026-118619)

CVE-2026-118618 (GCVE-0-2026-118618)

CVE-2026-118617 (GCVE-0-2026-118617)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.