Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
399142 vulnerabilities
No criteria set — showing every indexed entry of the selected sources, newest first by published date.
CVE-2026-102981 (GCVE-0-2026-102981)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:34 – Updated: 2026-10-13 15:34
VLAI
EPSS
VEX
Title
Plane: Unauthenticated Workspace Invitation Token Leakage
Summary
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0.
Severity
6.5 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/makeplane/plane/security/advis… | x_refsource_CONFIRM |
| https://github.com/makeplane/plane/pull/9297 | x_refsource_MISC |
| https://github.com/makeplane/plane/commit/6220ba9… | x_refsource_MISC |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "plane",
"vendor": "makeplane",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:34:25.761Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/makeplane/plane/security/advisories/GHSA-gf48-p6jp-cwc4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/makeplane/plane/security/advisories/GHSA-gf48-p6jp-cwc4"
},
{
"name": "https://github.com/makeplane/plane/pull/9297",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/pull/9297"
},
{
"name": "https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad"
},
{
"name": "https://github.com/makeplane/plane/releases/tag/v1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/releases/tag/v1.4.0"
}
],
"source": {
"advisory": "GHSA-gf48-p6jp-cwc4",
"discovery": "UNKNOWN"
},
"title": "Plane: Unauthenticated Workspace Invitation Token Leakage"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102981",
"datePublished": "2026-10-13T15:34:25.761Z",
"dateReserved": "2026-09-29T20:46:08.333Z",
"dateUpdated": "2026-10-13T15:34:25.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103965 (GCVE-0-2026-103965)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:33 – Updated: 2026-10-13 15:33
VLAI
EPSS
VEX
Title
Fixed values in MongoDB Server $bucket stage may be misread as field references
Summary
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.
Severity
5.4 (Medium)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | MongoDB Server |
Affected:
8.3.0 , < 8.3.13
(semver)
Affected: 8.0 , < 8.0.34 (semver) Affected: 7.0 , < 7.0.45 (semver) Affected: 9.0 , < 9.0.4 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "8.3.13",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.0.34",
"status": "affected",
"version": "8.0",
"versionType": "semver"
},
{
"lessThan": "7.0.45",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThan": "9.0.4",
"status": "affected",
"version": "9.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An issue in MongoDB Server\u0027s aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return."
}
],
"value": "An issue in MongoDB Server\u0027s aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:33:20.112Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-134618"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Fixed values in MongoDB Server $bucket stage may be misread as field references",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-103965",
"datePublished": "2026-10-13T15:33:20.112Z",
"dateReserved": "2026-10-01T15:53:56.581Z",
"dateUpdated": "2026-10-13T15:33:20.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102982 (GCVE-0-2026-102982)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:32 – Updated: 2026-10-13 15:32
VLAI
EPSS
VEX
Title
Plane: XSS in work item comments
Summary
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/makeplane/plane/security/advis… | x_refsource_CONFIRM |
| https://github.com/makeplane/plane/pull/9287 | x_refsource_MISC |
| https://github.com/makeplane/plane/commit/0d58adb… | x_refsource_MISC |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "plane",
"vendor": "makeplane",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:32:10.754Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/makeplane/plane/security/advisories/GHSA-6qrq-f73q-r67j"
},
{
"name": "https://github.com/makeplane/plane/pull/9287",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/pull/9287"
},
{
"name": "https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1"
},
{
"name": "https://github.com/makeplane/plane/releases/tag/v1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/releases/tag/v1.4.0"
}
],
"source": {
"advisory": "GHSA-6qrq-f73q-r67j",
"discovery": "UNKNOWN"
},
"title": "Plane: XSS in work item comments"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102982",
"datePublished": "2026-10-13T15:32:10.754Z",
"dateReserved": "2026-09-29T20:46:08.333Z",
"dateUpdated": "2026-10-13T15:32:10.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104935 (GCVE-0-2026-104935)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:31 – Updated: 2026-10-13 15:31Summary
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Severity
8.6 (High)
CWE
- CWE-290 - Authentication bypass by spoofing
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ivanti | Connect Secure |
Unaffected:
25.1.3.0
(custom)
Unaffected: 25.1.3.1 (custom) Unaffected: 22.8R2.5 (custom) Unaffected: 22.7R2.14 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Connect Secure",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "25.1.3.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "25.1.3.1",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "22.8R2.5",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "22.7R2.14",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior. \u0026nbsp;"
}
],
"value": "Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:31:07.757Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-104935",
"datePublished": "2026-10-13T15:31:07.757Z",
"dateReserved": "2026-10-02T17:07:30.656Z",
"dateUpdated": "2026-10-13T15:31:07.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102988 (GCVE-0-2026-102988)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:30 – Updated: 2026-10-13 15:30
VLAI
EPSS
VEX
Title
Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
Summary
Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled order_by parameter through order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0.
Severity
5.3 (Medium)
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/makeplane/plane/security/advis… | x_refsource_CONFIRM |
| https://github.com/makeplane/plane/pull/9292 | x_refsource_MISC |
| https://github.com/makeplane/plane/commit/cc3eb97… | x_refsource_MISC |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "plane",
"vendor": "makeplane",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled order_by parameter through order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django\u0027s order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:30:42.543Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/makeplane/plane/security/advisories/GHSA-2r95-c453-vxmr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/makeplane/plane/security/advisories/GHSA-2r95-c453-vxmr"
},
{
"name": "https://github.com/makeplane/plane/pull/9292",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/pull/9292"
},
{
"name": "https://github.com/makeplane/plane/commit/cc3eb974f1142146ddfedf7126cd4dfd376d32d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/commit/cc3eb974f1142146ddfedf7126cd4dfd376d32d1"
},
{
"name": "https://github.com/makeplane/plane/releases/tag/v1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/makeplane/plane/releases/tag/v1.4.0"
}
],
"source": {
"advisory": "GHSA-2r95-c453-vxmr",
"discovery": "UNKNOWN"
},
"title": "Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102988",
"datePublished": "2026-10-13T15:30:42.543Z",
"dateReserved": "2026-09-29T20:46:08.334Z",
"dateUpdated": "2026-10-13T15:30:42.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109526 (GCVE-0-2026-109526)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:30 – Updated: 2026-10-13 15:30
VLAI
EPSS
VEX
Title
HBAI-Ltd Toonflow-app exportData Endpoint information disclosure
Summary
A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/417195 | vdb-entry |
| https://vuldb.com/vuln/417195/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109526 | third-party-advisory |
| https://vuldb.com/submit/984380 | third-party-advisory |
| https://drive.google.com/drive/folders/13MjPi0zIn… | exploit |
| https://github.com/HBAI-Ltd/Toonflow-app/releases… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HBAI-Ltd | Toonflow-app |
Affected:
1.1.0
Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.3 Affected: 1.1.4 Affected: 1.1.5 Affected: 1.1.6 Affected: 1.1.7 Affected: 1.1.8 Unaffected: 2.0.0 cpe:2.3:a:hbai-ltd:toonflow-app:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:hbai-ltd:toonflow-app:*:*:*:*:*:*:*:*"
],
"modules": [
"exportData Endpoint"
],
"product": "Toonflow-app",
"vendor": "HBAI-Ltd",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.3"
},
{
"status": "affected",
"version": "1.1.4"
},
{
"status": "affected",
"version": "1.1.5"
},
{
"status": "affected",
"version": "1.1.6"
},
{
"status": "affected",
"version": "1.1.7"
},
{
"status": "affected",
"version": "1.1.8"
},
{
"status": "unaffected",
"version": "2.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "notwolf (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: \"The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:30:12.762Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-417195 | HBAI-Ltd Toonflow-app exportData Endpoint information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/417195"
},
{
"name": "VDB-417195 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/417195/cti"
},
{
"name": "CVE-2026-109526 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109526"
},
{
"name": "Submit #984380 | HBAI-Ltd Toonflow-app 1.1.8 Sensitive information exposure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/984380"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/drive/folders/13MjPi0zInT9Caau_fqD68FQ0z5fH0YsX?usp=sharing"
},
{
"tags": [
"patch"
],
"url": "https://github.com/HBAI-Ltd/Toonflow-app/releases/tag/v2.0.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T21:13:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "HBAI-Ltd Toonflow-app exportData Endpoint information disclosure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109526",
"datePublished": "2026-10-13T15:30:12.762Z",
"dateReserved": "2026-10-12T19:08:28.767Z",
"dateUpdated": "2026-10-13T15:30:12.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102734 (GCVE-0-2026-102734)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:29 – Updated: 2026-10-13 15:29
VLAI
EPSS
VEX
Title
asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
Summary
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.
Severity
5.5 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/lmfit/asteval/security/advisor… | x_refsource_CONFIRM |
| https://github.com/lmfit/asteval/pull/153 | x_refsource_MISC |
| https://github.com/lmfit/asteval/commit/a3e56e7f8… | x_refsource_MISC |
| https://github.com/lmfit/asteval/releases/tag/1.0.9 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "asteval",
"vendor": "lmfit",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-749",
"description": "CWE-749: Exposed Dangerous Method or Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-913",
"description": "CWE-913: Improper Control of Dynamically-Managed Code Resources",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:29:49.209Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx"
},
{
"name": "https://github.com/lmfit/asteval/pull/153",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/lmfit/asteval/pull/153"
},
{
"name": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4"
},
{
"name": "https://github.com/lmfit/asteval/releases/tag/1.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/lmfit/asteval/releases/tag/1.0.9"
}
],
"source": {
"advisory": "GHSA-9w56-46f6-3qhx",
"discovery": "UNKNOWN"
},
"title": "asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102734",
"datePublished": "2026-10-13T15:29:49.209Z",
"dateReserved": "2026-09-29T16:19:11.295Z",
"dateUpdated": "2026-10-13T15:29:49.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96299 (GCVE-0-2026-96299)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:27 – Updated: 2026-10-13 15:27
VLAI
EPSS
VEX
Title
MongoDB Nested `$_internalSchemaAllElemMatchFromIndex` Cross-Product MatchExpression OOM
Summary
Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory. Internal schema validation operators that are meant only for server use are accepted in user-supplied query filters. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without a sufficient limit on the resources used. This can cause memory use to grow until the mongod process runs out of memory and terminates. The behavior can occur when an authenticated user with read-only privileges runs an aggregation query that nests these operators.
Severity
CWE
- CWE-770 - Allocation of resources without limits or throttling
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | MongoDB Server |
Affected:
8.3.0 , < 8.3.13
(semver)
Affected: 9.0 , < 9.0.4 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "8.3.13",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "9.0.4",
"status": "affected",
"version": "9.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory. Internal schema validation operators that are meant only for server use are accepted in user-supplied query filters. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without a sufficient limit on the resources used. This can cause memory use to grow until the mongod process runs out of memory and terminates. The behavior can occur when an authenticated user with read-only privileges runs an aggregation query that nests these operators."
}
],
"value": "Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory. Internal schema validation operators that are meant only for server use are accepted in user-supplied query filters. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without a sufficient limit on the resources used. This can cause memory use to grow until the mongod process runs out of memory and terminates. The behavior can occur when an authenticated user with read-only privileges runs an aggregation query that nests these operators."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:27:57.250Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-130431"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MongoDB Nested `$_internalSchemaAllElemMatchFromIndex` Cross-Product MatchExpression OOM",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-96299",
"datePublished": "2026-10-13T15:27:57.250Z",
"dateReserved": "2026-09-22T22:29:05.501Z",
"dateUpdated": "2026-10-13T15:27:57.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96297 (GCVE-0-2026-96297)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:23 – Updated: 2026-10-13 15:23
VLAI
EPSS
VEX
Title
MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
Summary
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.
Severity
CWE
- CWE-416 - Use after free
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | MongoDB Server |
Affected:
8.3.0 , < 8.3.13
(semver)
Affected: 8.0 , < 8.0.34 (semver) Affected: 7.0 , < 7.0.45 (semver) Affected: 9.0 , < 9.0.2 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "8.3.13",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.0.34",
"status": "affected",
"version": "8.0",
"versionType": "semver"
},
{
"lessThan": "7.0.45",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThan": "9.0.2",
"status": "affected",
"version": "9.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings."
}
],
"value": "Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use after free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:23:57.051Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-132946"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-96297",
"datePublished": "2026-10-13T15:23:57.051Z",
"dateReserved": "2026-09-22T21:59:02.204Z",
"dateUpdated": "2026-10-13T15:23:57.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69150 (GCVE-0-2026-69150)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:23 – Updated: 2026-10-13 15:23
VLAI
EPSS
VEX
Title
KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map
Summary
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.
Severity
CWE
- CWE-416 - Use After Free
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/keepassxreboot/keepassxc/secur… | x_refsource_CONFIRM |
| https://github.com/keepassxreboot/keepassxc/commi… | x_refsource_MISC |
| https://github.com/keepassxreboot/keepassxc/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| keepassxreboot | keepassxc |
Affected:
< 2.8.0-beta1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "keepassxc",
"vendor": "keepassxreboot",
"versions": [
{
"status": "affected",
"version": "\u003c 2.8.0-beta1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:23:36.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4642-49vv-4p43",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4642-49vv-4p43"
},
{
"name": "https://github.com/keepassxreboot/keepassxc/commit/6a534f38c61295d60b0e937739a12511e76dbfeb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/keepassxreboot/keepassxc/commit/6a534f38c61295d60b0e937739a12511e76dbfeb"
},
{
"name": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0-beta1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0-beta1"
}
],
"source": {
"advisory": "GHSA-4642-49vv-4p43",
"discovery": "UNKNOWN"
},
"title": "KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69150",
"datePublished": "2026-10-13T15:23:36.744Z",
"dateReserved": "2026-08-03T15:47:09.654Z",
"dateUpdated": "2026-10-13T15:23:36.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102832 (GCVE-0-2026-102832)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:19 – Updated: 2026-10-13 15:19
VLAI
EPSS
VEX
Title
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
Summary
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Applications that bundle JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior. This issue is fixed in versions 4.5.11 and 4.6.4.
Severity
4.2 (Medium)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/jupyterlab/jupyterlab/security… | x_refsource_CONFIRM |
| https://github.com/jupyterlab/jupyterlab/commit/0… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/commit/b… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/commit/f… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/releases… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/releases… | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| jupyterlab | jupyterlab |
Affected:
>= 4.5.7, < 4.5.11
Affected: >= 4.6.0, < 4.6.4 |
|
| jupyterlab | jupyterlite-core |
Affected:
>= 0.7.5, < 0.8.4
|
|
| jupyterlab | notebook |
Affected:
>= 7.5.6, < 7.6.3
|
{
"containers": {
"cna": {
"affected": [
{
"product": "jupyterlab",
"vendor": "jupyterlab",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.5.7, \u003c 4.5.11"
},
{
"status": "affected",
"version": "\u003e= 4.6.0, \u003c 4.6.4"
}
]
},
{
"product": "jupyterlite-core",
"vendor": "jupyterlab",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.7.5, \u003c 0.8.4"
}
]
},
{
"product": "notebook",
"vendor": "jupyterlab",
"versions": [
{
"status": "affected",
"version": "\u003e= 7.5.6, \u003c 7.6.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Applications that bundle JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior. This issue is fixed in versions 4.5.11 and 4.6.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:19:40.699Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-jwrc-gm9j-263p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-jwrc-gm9j-263p"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/commit/0fc18ab4ef67e431a8f6560e387193baf786c70a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/commit/0fc18ab4ef67e431a8f6560e387193baf786c70a"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/commit/b64bc88b8ca034cf158604a5cc48ca9170ea453b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/commit/b64bc88b8ca034cf158604a5cc48ca9170ea453b"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/commit/f7e5f9803fdf2aaaa0e9bfb9cc73386a8cc5f0b2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/commit/f7e5f9803fdf2aaaa0e9bfb9cc73386a8cc5f0b2"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"
}
],
"source": {
"advisory": "GHSA-jwrc-gm9j-263p",
"discovery": "UNKNOWN"
},
"title": "JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102832",
"datePublished": "2026-10-13T15:19:40.699Z",
"dateReserved": "2026-09-29T17:25:25.266Z",
"dateUpdated": "2026-10-13T15:19:40.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55675 (GCVE-0-2026-55675)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:15 – Updated: 2026-10-13 15:15
VLAI
EPSS
VEX
Title
Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
Summary
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
Severity
10 (Critical)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/saltyorg/docs/security/advisor… | x_refsource_CONFIRM |
| https://github.com/saltyorg/docs/commit/649c9aea2… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "docs",
"vendor": "saltyorg",
"versions": [
{
"status": "affected",
"version": "\u003c 649c9aea2daef1168eeb0415b44e65dbbde9f220"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1357",
"description": "CWE-1357: Reliance on Insufficiently Trustworthy Component",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:15:25.023Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/saltyorg/docs/security/advisories/GHSA-wr2h-fpxm-ff4x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/saltyorg/docs/security/advisories/GHSA-wr2h-fpxm-ff4x"
},
{
"name": "https://github.com/saltyorg/docs/commit/649c9aea2daef1168eeb0415b44e65dbbde9f220",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/saltyorg/docs/commit/649c9aea2daef1168eeb0415b44e65dbbde9f220"
}
],
"source": {
"advisory": "GHSA-wr2h-fpxm-ff4x",
"discovery": "UNKNOWN"
},
"title": "Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55675",
"datePublished": "2026-10-13T15:15:25.023Z",
"dateReserved": "2026-06-17T00:05:03.778Z",
"dateUpdated": "2026-10-13T15:15:25.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109525 (GCVE-0-2026-109525)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:15 – Updated: 2026-10-13 15:24
VLAI
EPSS
VEX
Title
girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
Summary
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:24 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/417189 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/417189/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109525 | third-party-advisory |
| https://vuldb.com/submit/984343 | third-party-advisory |
| https://github.com/girishsaraf/Online-Appointment… | exploitissue-tracking |
| https://github.com/girishsaraf/Online-Appointment… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| girishsaraf | Online-Appointment-Booking-System |
Affected:
f427b4757128ca253d33d0cc4e87bbb9c999a4d5
cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109525",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:24:06.182543Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:24:17.093Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"
],
"modules": [
"submit2 Handler"
],
"product": "Online-Appointment-Booking-System",
"vendor": "girishsaraf",
"versions": [
{
"status": "affected",
"version": "f427b4757128ca253d33d0cc4e87bbb9c999a4d5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "huimouwaner (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:15:17.321Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-417189 | girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/417189"
},
{
"name": "VDB-417189 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/417189/cti"
},
{
"name": "CVE-2026-109525 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109525"
},
{
"name": "Submit #984343 | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/984343"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/15"
},
{
"tags": [
"product"
],
"url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T21:09:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109525",
"datePublished": "2026-10-13T15:15:17.321Z",
"dateReserved": "2026-10-12T19:04:30.719Z",
"dateUpdated": "2026-10-13T15:24:17.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55376 (GCVE-0-2026-55376)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:12 – Updated: 2026-10-13 15:12
VLAI
EPSS
VEX
Title
heym Python Tool Sandbox Escape
Summary
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.
Severity
8.8 (High)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/heymrun/heym/security/advisori… | x_refsource_CONFIRM |
| https://github.com/heymrun/heym/commit/b36d795c6e… | x_refsource_MISC |
| https://github.com/heymrun/heym/releases/tag/v0.0.40 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "heym",
"vendor": "heymrun",
"versions": [
{
"status": "affected",
"version": "\u003c 0.0.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:12:49.604Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heymrun/heym/security/advisories/GHSA-wcgw-9hfw-f6f2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heymrun/heym/security/advisories/GHSA-wcgw-9hfw-f6f2"
},
{
"name": "https://github.com/heymrun/heym/commit/b36d795c6ea841b8f1b511a0952e274487ee4ef3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heymrun/heym/commit/b36d795c6ea841b8f1b511a0952e274487ee4ef3"
},
{
"name": "https://github.com/heymrun/heym/releases/tag/v0.0.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heymrun/heym/releases/tag/v0.0.40"
}
],
"source": {
"advisory": "GHSA-wcgw-9hfw-f6f2",
"discovery": "UNKNOWN"
},
"title": "heym Python Tool Sandbox Escape"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55376",
"datePublished": "2026-10-13T15:12:49.604Z",
"dateReserved": "2026-06-16T18:57:40.181Z",
"dateUpdated": "2026-10-13T15:12:49.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105460 (GCVE-0-2026-105460)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:12 – Updated: 2026-10-13 15:12
VLAI
EPSS
VEX
Title
Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()
Summary
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.
Severity
5.5 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-105460 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2545923 | issue-trackingx_refsource_REDHAT |
| https://redhat.atlassian.net/browse/PSIRTSUPT-24932 |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
Date Public
2026-10-13 13:55
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "bluez",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "affected",
"packageName": "bluez",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "bluez",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "bluez",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "bluez",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank zhailiangliang (Loongson Technology) for reporting this issue."
}
],
"datePublic": "2026-10-13T13:55:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Low"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:12:19.969Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-105460"
},
{
"name": "RHBZ#2545923",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545923"
},
{
"url": "https://redhat.atlassian.net/browse/PSIRTSUPT-24932"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-30T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-13T13:55:00.000Z",
"value": "Made public."
}
],
"title": "Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()",
"workarounds": [
{
"lang": "en",
"value": "Do not open untrusted btsnoop capture files with btmon."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-125: Out-of-bounds Read"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-105460",
"datePublished": "2026-10-13T15:12:19.969Z",
"dateReserved": "2026-10-05T14:29:05.211Z",
"dateUpdated": "2026-10-13T15:12:19.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81507 (GCVE-0-2026-81507)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:12 – Updated: 2026-10-13 15:12
VLAI
EPSS
VEX
Title
ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
Summary
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
Severity
6.5 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/espressif/esp-idf/security/adv… | x_refsource_CONFIRM |
| https://github.com/espressif/esp-idf/commit/14c99… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/commit/1e07f… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/commit/5731c… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/commit/8de26… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/commit/9a6d0… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/commit/c2610… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/commit/c8cd8… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/releases/tag… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/releases/tag… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/releases/tag… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/releases/tag… | x_refsource_MISC |
| https://github.com/espressif/esp-idf/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "esp-idf",
"vendor": "espressif",
"versions": [
{
"status": "affected",
"version": "\u003c 5.2.8"
},
{
"status": "affected",
"version": "\u003e= 5.3-beta1, \u003c 5.3.6"
},
{
"status": "affected",
"version": "\u003e= 5.4-beta1, \u003c 5.5.5"
},
{
"status": "affected",
"version": "\u003e= 6.0-beta1, \u003c 6.0.3"
},
{
"status": "affected",
"version": "\u003e= 6.1-beta1, \u003c 6.1-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:12:01.010Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/espressif/esp-idf/security/advisories/GHSA-v335-fxwc-rc44",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-v335-fxwc-rc44"
},
{
"name": "https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/commit/14c99559b4337cabcf0f09c21d16b93c4cd7a6fe"
},
{
"name": "https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/commit/1e07f6d83ca892630a7210df2958455f7ca77b4a"
},
{
"name": "https://github.com/espressif/esp-idf/commit/5731c63ece128f156939b9f734256e2227c1442a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/commit/5731c63ece128f156939b9f734256e2227c1442a"
},
{
"name": "https://github.com/espressif/esp-idf/commit/8de265dc44b1b22c749ea44ee7c609b3da4162f0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/commit/8de265dc44b1b22c749ea44ee7c609b3da4162f0"
},
{
"name": "https://github.com/espressif/esp-idf/commit/9a6d04f65e0e341e7d72bd417c9f31b8a04ce846",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/commit/9a6d04f65e0e341e7d72bd417c9f31b8a04ce846"
},
{
"name": "https://github.com/espressif/esp-idf/commit/c2610255a5adce651ca582bb82368c3dd0ee2834",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/commit/c2610255a5adce651ca582bb82368c3dd0ee2834"
},
{
"name": "https://github.com/espressif/esp-idf/commit/c8cd8f4f3019ae2f912c8cbe9974445e8d9b8749",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/commit/c8cd8f4f3019ae2f912c8cbe9974445e8d9b8749"
},
{
"name": "https://github.com/espressif/esp-idf/releases/tag/v5.2.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/releases/tag/v5.2.8"
},
{
"name": "https://github.com/espressif/esp-idf/releases/tag/v5.3.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/releases/tag/v5.3.6"
},
{
"name": "https://github.com/espressif/esp-idf/releases/tag/v5.5.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/releases/tag/v5.5.5"
},
{
"name": "https://github.com/espressif/esp-idf/releases/tag/v6.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/releases/tag/v6.0.3"
},
{
"name": "https://github.com/espressif/esp-idf/releases/tag/v6.1-rc1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/espressif/esp-idf/releases/tag/v6.1-rc1"
}
],
"source": {
"advisory": "GHSA-v335-fxwc-rc44",
"discovery": "UNKNOWN"
},
"title": "ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81507",
"datePublished": "2026-10-13T15:12:01.010Z",
"dateReserved": "2026-08-26T20:58:58.083Z",
"dateUpdated": "2026-10-13T15:12:01.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109524 (GCVE-0-2026-109524)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:00 – Updated: 2026-10-13 15:00
VLAI
EPSS
VEX
Title
girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
Summary
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/417188 | vdb-entry |
| https://vuldb.com/vuln/417188/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109524 | third-party-advisory |
| https://vuldb.com/submit/984342 | third-party-advisory |
| https://github.com/girishsaraf/Online-Appointment… | exploitissue-tracking |
| https://github.com/girishsaraf/Online-Appointment… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| girishsaraf | Online-Appointment-Booking-System |
Affected:
f427b4757128ca253d33d0cc4e87bbb9c999a4d5
cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Admin Display Pages"
],
"product": "Online-Appointment-Booking-System",
"vendor": "girishsaraf",
"versions": [
{
"status": "affected",
"version": "f427b4757128ca253d33d0cc4e87bbb9c999a4d5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "a86402175 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:00:14.312Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-417188 | girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/417188"
},
{
"name": "VDB-417188 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/417188/cti"
},
{
"name": "CVE-2026-109524 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109524"
},
{
"name": "Submit #984342 | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/984342"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/14"
},
{
"tags": [
"product"
],
"url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T21:09:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109524",
"datePublished": "2026-10-13T15:00:14.312Z",
"dateReserved": "2026-10-12T19:04:25.647Z",
"dateUpdated": "2026-10-13T15:00:14.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106108 (GCVE-0-2026-106108)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:55 – Updated: 2026-10-13 14:55
VLAI
EPSS
VEX
Title
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
>= 2.22.0, < 2.23.3
|
|
| @quasar | app-vite |
Affected:
>= 3.1.0, < 3.3.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.22.0, \u003c 2.23.3"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.1.0, \u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user\u0027s permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer\u0027s no-overwrite behavior. This issue is fixed in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:55:50.358Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-vhhq-m2gm-rwc9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-vhhq-m2gm-rwc9"
},
{
"name": "https://github.com/quasarframework/quasar/commit/cdd4daeec839215540221122763c7a17cd478abc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/cdd4daeec839215540221122763c7a17cd478abc"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
}
],
"source": {
"advisory": "GHSA-vhhq-m2gm-rwc9",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106108",
"datePublished": "2026-10-13T14:55:50.358Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-13T14:55:50.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103028 (GCVE-0-2026-103028)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:54 – Updated: 2026-10-13 14:54
VLAI
EPSS
VEX
Title
SFTPGo source-side file-pattern filter bypass during copy operations
Summary
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6.
Severity
4.3 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/drakkan/sftpgo/security/adviso… | x_refsource_CONFIRM |
| https://github.com/drakkan/sftpgo/commit/dc8886bc… | x_refsource_MISC |
| https://github.com/drakkan/sftpgo/releases/tag/v2.7.6 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "sftpgo",
"vendor": "drakkan",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.5.0, \u003c 2.7.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:54:47.246Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-wwv9-g5x4-966q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-wwv9-g5x4-966q"
},
{
"name": "https://github.com/drakkan/sftpgo/commit/dc8886bc079094b4ac2338df683f358b7676b5eb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/drakkan/sftpgo/commit/dc8886bc079094b4ac2338df683f358b7676b5eb"
},
{
"name": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.6"
}
],
"source": {
"advisory": "GHSA-wwv9-g5x4-966q",
"discovery": "UNKNOWN"
},
"title": "SFTPGo source-side file-pattern filter bypass during copy operations"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-103028",
"datePublished": "2026-10-13T14:54:47.246Z",
"dateReserved": "2026-09-29T21:13:24.032Z",
"dateUpdated": "2026-10-13T14:54:47.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77375 (GCVE-0-2026-77375)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:52 – Updated: 2026-10-13 15:24
VLAI
EPSS
VEX
Title
SFTPGo: Denial of service via malformed SSH channel request
Summary
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:24 UTC
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/drakkan/sftpgo/security/adviso… | x_refsource_CONFIRM |
| https://github.com/drakkan/sftpgo/commit/4f751232… | x_refsource_MISC |
| https://github.com/drakkan/sftpgo/releases/tag/v2.7.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:24:50.582404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:24:59.888Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sftpgo",
"vendor": "drakkan",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129: Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:52:46.056Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-q7pc-356p-hggc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-q7pc-356p-hggc"
},
{
"name": "https://github.com/drakkan/sftpgo/commit/4f751232d7025cf2f7360e01ee8dca81e74b48b0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/drakkan/sftpgo/commit/4f751232d7025cf2f7360e01ee8dca81e74b48b0"
},
{
"name": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/drakkan/sftpgo/releases/tag/v2.7.5"
}
],
"source": {
"advisory": "GHSA-q7pc-356p-hggc",
"discovery": "UNKNOWN"
},
"title": "SFTPGo: Denial of service via malformed SSH channel request"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77375",
"datePublished": "2026-10-13T14:52:46.056Z",
"dateReserved": "2026-08-20T19:36:13.805Z",
"dateUpdated": "2026-10-13T15:24:59.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102250 (GCVE-0-2026-102250)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:51 – Updated: 2026-10-13 14:51
VLAI
EPSS
VEX
Summary
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
Severity
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Schneider Electric | Sage RTU 1410 |
Affected:
All versions prior to version C3414-500-S02L0
|
|
| Schneider Electric | Sage RTU 1430 |
Affected:
All versions prior to version C3414-500-S02L0
|
|
| Schneider Electric | Sage RTU 1450 |
Affected:
All versions prior to version C3414-500-S02L0
|
|
| Schneider Electric | Sage RTU 2400 |
Affected:
All versions prior to version C3414-500-S02L0
|
|
| Schneider Electric | Sage RTU 3030 Magnum |
Affected:
All versions prior to version C3414-500-S02L0
|
|
| Schneider Electric | Sage RTU 4400 |
Affected:
All versions prior to version C3414-500-S02L0
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sage RTU 1410",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All versions prior to version C3414-500-S02L0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage RTU 1430",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All versions prior to version C3414-500-S02L0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage RTU 1450",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All versions prior to version C3414-500-S02L0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage RTU 2400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All versions prior to version C3414-500-S02L0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage RTU 3030 Magnum",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All versions prior to version C3414-500-S02L0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage RTU 4400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All versions prior to version C3414-500-S02L0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device."
}
],
"value": "CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:51:48.442Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-286-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2026-286-02.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2026-102250",
"datePublished": "2026-10-13T14:51:48.442Z",
"dateReserved": "2026-09-28T19:04:55.353Z",
"dateUpdated": "2026-10-13T14:51:48.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107918 (GCVE-0-2026-107918)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:50 – Updated: 2026-10-13 14:50
VLAI
EPSS
VEX
Title
Insufficient input validation vulnerability in NETGEAR R7300
Summary
Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
Severity
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.netgear.com/support/product/r7300dst | productpatch |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "R7300DST",
"vendor": "NETGEAR",
"versions": [
{
"lessThanOrEqual": "V1 1.0.0.74",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Security Research Center (SRC) @ Concordia University"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router\u0026nbsp;allows authenticated administrators connected to the local network to perform unauthorized actions on the router.\u003cspan\u003eThis issue was identified through testing in a controlled research environment using a simulated version of the router\u0027s software and has not been confirmed on physical production devices.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router\u00a0allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a simulated version of the router\u0027s software and has not been confirmed on physical production devices."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:50:33.244Z",
"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"shortName": "NETGEAR"
},
"references": [
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/r7300dst"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDevices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\u003c/p\u003e\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eProduct\u003c/th\u003e\u003cth\u003eFixed Version\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eR7300DST (EoS)\u003c/b\u003e Nighthawk AC1900 DST Router \u0026amp; Adapter\u003c/td\u003e\u003ctd\u003eWon\u0027t Fix\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003eModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.\u003c/p\u003e"
}
],
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionR7300DST (EoS) Nighthawk AC1900 DST Router \u0026 AdapterWon\u0027t Fix\n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficient input validation vulnerability in NETGEAR R7300",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"assignerShortName": "NETGEAR",
"cveId": "CVE-2026-107918",
"datePublished": "2026-10-13T14:50:33.244Z",
"dateReserved": "2026-10-09T05:39:28.261Z",
"dateUpdated": "2026-10-13T14:50:33.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107917 (GCVE-0-2026-107917)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:46 – Updated: 2026-10-13 14:46
VLAI
EPSS
VEX
Title
Insufficient input validation vulnerability in NETGEAR R7300 router
Summary
Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.
Severity
CWE
- CWE-20 - Improper input validation
Assigner
References
1 reference
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "R7300DST",
"vendor": "NETGEAR",
"versions": [
{
"lessThanOrEqual": "V1.0.0.74",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Security Research Center (SRC) @ Concordia University"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router\u0026nbsp;allows authenticated administrators connected to the local network to perform unauthorized actions on the router.\u0026nbsp;\u003cspan\u003eThis issue was identified through testing in a controlled research environment using a simulated version of the router\u0027s software and has not been confirmed on physical production devices.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router\u00a0allows authenticated administrators connected to the local network to perform unauthorized actions on the router.\u00a0This issue was identified through testing in a controlled research environment using a simulated version of the router\u0027s software and has not been confirmed on physical production devices."
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:46:32.629Z",
"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"shortName": "NETGEAR"
},
"references": [
{
"url": "https://www.netgear.com/support/product/r7300dst"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDevices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\u003c/p\u003e\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eProduct\u003c/th\u003e\u003cth\u003eFixed Version\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eR7300DST (EoS)\u003c/b\u003e Nighthawk AC1900 DST Router \u0026amp; Adapter\u003c/td\u003e\u003ctd\u003eWon\u0027t Fix\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003eModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.\u003c/p\u003e"
}
],
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionR7300DST (EoS) Nighthawk AC1900 DST Router \u0026 AdapterWon\u0027t Fix\n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficient input validation vulnerability in NETGEAR R7300 router",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"assignerShortName": "NETGEAR",
"cveId": "CVE-2026-107917",
"datePublished": "2026-10-13T14:46:32.629Z",
"dateReserved": "2026-10-09T05:39:20.068Z",
"dateUpdated": "2026-10-13T14:46:32.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109523 (GCVE-0-2026-109523)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:45 – Updated: 2026-10-13 14:45
VLAI
EPSS
VEX
Title
girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection
Summary
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/417187 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/417187/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109523 | third-party-advisory |
| https://vuldb.com/submit/984341 | third-party-advisory |
| https://github.com/girishsaraf/Online-Appointment… | exploitissue-tracking |
| https://github.com/girishsaraf/Online-Appointment… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| girishsaraf | Online-Appointment-Booking-System |
Affected:
f427b4757128ca253d33d0cc4e87bbb9c999a4d5
cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"
],
"modules": [
"AJAX Endpoint"
],
"product": "Online-Appointment-Booking-System",
"vendor": "girishsaraf",
"versions": [
{
"status": "affected",
"version": "f427b4757128ca253d33d0cc4e87bbb9c999a4d5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "DOUzhen131415 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:45:19.660Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-417187 | girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/417187"
},
{
"name": "VDB-417187 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/417187/cti"
},
{
"name": "CVE-2026-109523 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109523"
},
{
"name": "Submit #984341 | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/984341"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/13"
},
{
"tags": [
"product"
],
"url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T21:09:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109523",
"datePublished": "2026-10-13T14:45:19.660Z",
"dateReserved": "2026-10-12T19:04:22.047Z",
"dateUpdated": "2026-10-13T14:45:19.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104192 (GCVE-0-2026-104192)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:42 – Updated: 2026-10-13 15:26
VLAI
EPSS
VEX
Title
DragonflyDB stream RDB deserialization double-free
Summary
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:25 UTC
CWE
- CWE-415 - Double Free
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/dragonflydb/dragonfly/security… | x_refsource_CONFIRM |
| https://github.com/dragonflydb/dragonfly/pull/7929 | x_refsource_MISC |
| https://github.com/dragonflydb/dragonfly/commit/6… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dragonflydb | dragonfly |
Affected:
< 1.40
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:25:47.878490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:26:00.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dragonfly",
"vendor": "dragonflydb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group\u0027s global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and potentially attacker-controlled code execution as the Dragonfly service account. The source fix has not yet been mapped to a published release."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415: Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:42:54.248Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cg35-6jf4-crfh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dragonflydb/dragonfly/security/advisories/GHSA-cg35-6jf4-crfh"
},
{
"name": "https://github.com/dragonflydb/dragonfly/pull/7929",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dragonflydb/dragonfly/pull/7929"
},
{
"name": "https://github.com/dragonflydb/dragonfly/commit/6c6b27a5cfd03d67eb9583ab84a0f0709e3bc77e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dragonflydb/dragonfly/commit/6c6b27a5cfd03d67eb9583ab84a0f0709e3bc77e"
}
],
"source": {
"advisory": "GHSA-cg35-6jf4-crfh",
"discovery": "UNKNOWN"
},
"title": "DragonflyDB stream RDB deserialization double-free"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-104192",
"datePublished": "2026-10-13T14:42:54.248Z",
"dateReserved": "2026-10-01T18:54:15.119Z",
"dateUpdated": "2026-10-13T15:26:00.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11732 (GCVE-0-2026-11732)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:42 – Updated: 2026-10-13 14:42
VLAI
EPSS
VEX
Title
Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models
Summary
An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.
Severity
CWE
- CWE-20 - Improper input validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.netgear.com/support/product/cax30/ | productpatch |
| https://www.netgear.com/support/product/rax5/ | productpatch |
| https://www.netgear.com/support/product/rax30/ | productpatch |
| https://www.netgear.com/support/product/raxe300/ | productpatch |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CAX30",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "V2.3.4.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RAX30",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "V1.0.14.108",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RAX5",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "V1.0.5.34",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RAXE300",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "V1.0.10.72",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kaoken"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eAn insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.\u003c/p\u003e"
}
],
"value": "An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:42:50.698Z",
"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"shortName": "NETGEAR"
},
"references": [
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/cax30/"
},
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/rax5/"
},
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/rax30/"
},
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/raxe300/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDevices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\u003c/p\u003e\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eProduct\u003c/th\u003e\u003cth\u003eFixed Version\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eCAX30\u003c/b\u003e Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router\u003c/td\u003e\u003ctd\u003e\n\n\u003cp\u003e\u003ca href=\"https://www.netgear.com/support/product/cax30/\"\u003e\u003cspan\u003eV2.3.4.12\u003c/span\u003e\u003c/a\u003e\u003c/p\u003e\n\n\n\n\n\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eRAX30\u003c/b\u003e Nighthawk AX5 5-Stream AX2400 WiFi 6 Router\u003c/td\u003e\u003ctd\u003e\n\n\u003cp\u003e\u003ca href=\"https://www.netgear.com/support/product/rax30/\"\u003eV1.0.14.108\u003c/a\u003e\u003c/p\u003e\n\n\n\n\n\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eRAX5 (EoS)\u003c/b\u003e 4-Stream AX1600 WiFi 6 Router\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.netgear.com/support/product/rax5/\"\u003eV1.0.5.34\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eRAXE300\u003c/b\u003e Nighthawk AXE7800 Tri-Band WiFi 6E Router\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.netgear.com/support/product/raxe300/\"\u003eV1.0.10.72\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003eModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.\u003c/p\u003e"
}
],
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionCAX30 Nighthawk AX6 6-Stream WiFi 6 Cable Modem Router\n\n\n\n V2.3.4.12 https://www.netgear.com/support/product/cax30/ \n\n\n\n\n\n\nRAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router\n\n\n\n V1.0.14.108 https://www.netgear.com/support/product/rax30/ \n\n\n\n\n\n\nRAX5 (EoS) 4-Stream AX1600 WiFi 6 Router V1.0.5.34 https://www.netgear.com/support/product/rax5/ RAXE300 Nighthawk AXE7800 Tri-Band WiFi 6E Router V1.0.10.72 https://www.netgear.com/support/product/raxe300/ \n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"assignerShortName": "NETGEAR",
"cveId": "CVE-2026-11732",
"datePublished": "2026-10-13T14:42:50.698Z",
"dateReserved": "2026-06-09T02:46:41.216Z",
"dateUpdated": "2026-10-13T14:42:50.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11731 (GCVE-0-2026-11731)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:41 – Updated: 2026-10-13 14:41
VLAI
EPSS
VEX
Title
Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models
Summary
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.
Severity
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.netgear.com/support/product/rax30 | productpatch |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RAX30",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "v1.0.15.110",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RAX29",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "v1.0.15.110",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RAX28",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "v1.0.15.110",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yanming Chen of Guangzhou University"
},
{
"lang": "en",
"type": "finder",
"value": "Michael Gentile"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device\u2019s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.\u003c/p\u003e"
}
],
"value": "An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device\u2019s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/V:D/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:41:42.298Z",
"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"shortName": "NETGEAR"
},
"references": [
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/rax30"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDevices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\u003c/p\u003e\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eProduct\u003c/th\u003e\u003cth\u003eFixed Version\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eRAX28\u003c/b\u003e Nighthawk AX5 5-Stream AX2200 WiFi 6 Router\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.netgear.com/support/product/rax28\"\u003ev1.0.15.110\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eRAX29\u003c/b\u003e Nighthawk AX2400 WiFi 6 Router\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.netgear.com/support/product/rax29\"\u003ev1.0.15.110\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eRAX30\u003c/b\u003e Nighthawk AX5 5-Stream AX2400 WiFi 6 Router\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.netgear.com/support/product/rax30\"\u003ev1.0.15.110\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionRAX28 Nighthawk AX5 5-Stream AX2200 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax28 RAX29 Nighthawk AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax29 RAX30 Nighthawk AX5 5-Stream AX2400 WiFi 6 Router v1.0.15.110 https://www.netgear.com/support/product/rax30"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"assignerShortName": "NETGEAR",
"cveId": "CVE-2026-11731",
"datePublished": "2026-10-13T14:41:42.298Z",
"dateReserved": "2026-06-09T02:46:39.902Z",
"dateUpdated": "2026-10-13T14:41:42.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11730 (GCVE-0-2026-11730)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:38 – Updated: 2026-10-13 14:38
VLAI
EPSS
VEX
Title
Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models
Summary
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
Severity
CWE
- CWE-335 - Incorrect usage of seeds in Pseudo-Random number generator (PRNG)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.netgear.com/support/product/ex3700 | productpatch |
| https://www.netgear.com/support/product/ex6120 | productpatch |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EX3700",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "V1.0.0.102",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EX6120",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "V1.0.1.74",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "KDec5ae262-35b5-41c5-9bc1-91ad34145487 and Austin Turecek (Collaborator)"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal."
}
],
"impacts": [
{
"capecId": "CAPEC-593",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-593 Session Hijacking"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-335",
"description": "CWE-335 Incorrect usage of seeds in Pseudo-Random number generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:38:16.110Z",
"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"shortName": "NETGEAR"
},
"references": [
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/ex3700"
},
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/ex6120"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDevices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\u003c/p\u003e\u003ctable style=\"border-collapse:collapse;\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"\u003eProduct\u003c/th\u003e\u003cth style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"\u003eFixed Version\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"\u003e\u003cb\u003eEX3700 (EoS)\u003c/b\u003e AC750 WiFi Range Extender Essentials Edition\u003c/td\u003e\u003ctd style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"\u003e\u003ca href=\"https://www.netgear.com/support/product/ex3700\"\u003eV1.0.0.102\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"\u003e\u003cb\u003eEX6120\u003c/b\u003e AC1200 Dual Band WiFi Range Extender\u003c/td\u003e\u003ctd style=\"border:1px solid gray;padding:4px 8px;text-align:left;\"\u003e\u003ca href=\"https://www.netgear.com/support/product/ex6120\"\u003eV1.0.1.74\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003eModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.\u003c/p\u003e"
}
],
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionEX3700 (EoS) AC750 WiFi Range Extender Essentials Edition V1.0.0.102 https://www.netgear.com/support/product/ex3700 EX6120 AC1200 Dual Band WiFi Range Extender V1.0.1.74 https://www.netgear.com/support/product/ex6120 \n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"assignerShortName": "NETGEAR",
"cveId": "CVE-2026-11730",
"datePublished": "2026-10-13T14:38:16.110Z",
"dateReserved": "2026-06-09T02:46:38.130Z",
"dateUpdated": "2026-10-13T14:38:16.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9218 (GCVE-0-2026-9218)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:34 – Updated: 2026-10-13 14:34
VLAI
EPSS
VEX
Title
Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access
Summary
Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.
Severity
CWE
- CWE-20 - Improper input validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.netgear.com/support/product/r7000/ | productpatch |
| https://www.netgear.com/support/product/cbr40/ | productpatch |
| https://www.netgear.com/support/product/r7000p/ | productpatch |
| https://www.netgear.com/support/product/rax40/ | productpatch |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CBR40",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "R7000",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "v1.0.11.130",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "R7000P",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "V1.3.3.152",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RAX40",
"vendor": "NETGEAR",
"versions": [
{
"lessThan": "V1.0.3.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "unprovable"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eInsufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router\u2019s local network and has the router\u2019s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router.\u003c/p\u003e"
}
],
"value": "Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router\u2019s local network and has the router\u2019s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/V:D/RE:L/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:34:34.055Z",
"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"shortName": "NETGEAR"
},
"references": [
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/r7000/"
},
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/cbr40/"
},
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/r7000p/"
},
{
"tags": [
"product",
"patch"
],
"url": "https://www.netgear.com/support/product/rax40/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDevices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\u003c/p\u003e\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eProduct\u003c/th\u003e\u003cth\u003eFixed Version\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eCBR40 (EoS)\u003c/b\u003e Orbi AC2200 Tri-band WiFi Cable Modem Router\u003c/td\u003e\u003ctd\u003eWon\u0027t Fix\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eR7000 (EoS)\u003c/b\u003e Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.netgear.com/support/product/r7000\"\u003ev1.0.11.130\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eR7000P (EoS)\u003c/b\u003e Nighthawk AC2300 Smart WiFi Dual Band Gigabit Router\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.netgear.com/support/product/r7000p\"\u003eV1.3.3.152\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cb\u003eRAX40 (EoS)\u003c/b\u003e Nighthawk AX4 4-Stream WiFi Router\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.netgear.com/support/product/rax40\"\u003eV1.0.3.64\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cp\u003eModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support.\u003c/p\u003e"
}
],
"value": "Devices with automatic updates enabled may already have this patch applied. If not, please check the firmware version and update it to the latest. Fixed in:\n\nProductFixed VersionCBR40 (EoS) Orbi AC2200 Tri-band WiFi Cable Modem RouterWon\u0027t FixR7000 (EoS) Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router v1.0.11.130 https://www.netgear.com/support/product/r7000 R7000P (EoS) Nighthawk AC2300 Smart WiFi Dual Band Gigabit Router V1.3.3.152 https://www.netgear.com/support/product/r7000p RAX40 (EoS) Nighthawk AX4 4-Stream WiFi Router V1.0.3.64 https://www.netgear.com/support/product/rax40 \n\nModels marked (EoS) have reached End-of-Support phase, and no security updates are planned. NETGEAR strongly recommends that you retire these devices and upgrade to a newer NETGEAR device for continued security support."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5",
"assignerShortName": "NETGEAR",
"cveId": "CVE-2026-9218",
"datePublished": "2026-10-13T14:34:34.055Z",
"dateReserved": "2026-05-21T17:29:15.526Z",
"dateUpdated": "2026-10-13T14:34:34.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53711 (GCVE-0-2026-53711)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:34 – Updated: 2026-10-13 14:34
VLAI
EPSS
VEX
Title
MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
Summary
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/IBM/mcp-context-forge/security… | x_refsource_CONFIRM |
| https://github.com/IBM/mcp-context-forge/pull/337 | x_refsource_MISC |
| https://github.com/IBM/mcp-context-forge/commit/a… | x_refsource_MISC |
| https://github.com/IBM/mcp-context-forge/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | mcp-context-forge |
Affected:
>= 0.2.0, < 0.3.1
|
{
"containers": {
"cna": {
"affected": [
{
"product": "mcp-context-forge",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.2.0, \u003c 0.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer\u0027s browser session. This issue is fixed in version 0.3.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:34:01.069Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-x6gc-rm5j-55mw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-x6gc-rm5j-55mw"
},
{
"name": "https://github.com/IBM/mcp-context-forge/pull/337",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/IBM/mcp-context-forge/pull/337"
},
{
"name": "https://github.com/IBM/mcp-context-forge/commit/acd16196158f9a393187551b21a2fc61650f2e3d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/IBM/mcp-context-forge/commit/acd16196158f9a393187551b21a2fc61650f2e3d"
},
{
"name": "https://github.com/IBM/mcp-context-forge/releases/tag/v0.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/IBM/mcp-context-forge/releases/tag/v0.3.1"
}
],
"source": {
"advisory": "GHSA-x6gc-rm5j-55mw",
"discovery": "UNKNOWN"
},
"title": "MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53711",
"datePublished": "2026-10-13T14:34:01.069Z",
"dateReserved": "2026-06-10T16:43:31.241Z",
"dateUpdated": "2026-10-13T14:34:01.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}