{"generatedAt":"2026-11-02T15:36:09.311Z","windowHours":24,"vulns":[{"id":"CVE-2026-111497","published":"2026-10-27","description":"Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["google"],"products":["brotli"],"cwes":[],"references":[],"affected":[],"origin":"kev","epss":0.82641,"epssPercentile":0.99667,"kev":{"name":"Google Brotli Unchecked Return Value Vulnerability","dateAdded":"2026-10-27","dueDate":"2026-11-10","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."},"ssvc":null,"mentions":[{"source":"Microsoft","kind":"editeur","title":"CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497","published":"2026-10-31T08:13:53.000Z"},{"source":"Palo Alto Networks","kind":"editeur","title":"CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)","link":"https://security.paloaltonetworks.com/CVE-2026-111497","published":"2026-10-31T03:15:00.000Z"},{"source":"Cisco","kind":"editeur","title":"Vulnerabilities in Node.js Affecting Cisco Products: October 2026","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Vulnerabilities%20in%20Node.js%20Affecting%20Cisco%20Products:%20October%202026%26vs_k=1","published":"2026-10-30T19:55:59.000Z"},{"source":"Ubuntu","kind":"editeur","title":"USN-8958-1: .NET vulnerabilities","link":"https://ubuntu.com/security/notices/USN-8958-1","published":"2026-10-29T17:02:55.000Z"},{"source":"CISA","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-27T12:00:00.000Z"},{"source":"Fortinet","kind":"editeur","title":"Node2Shell CVEs","link":"https://fortiguard.fortinet.com/psirt/FG-IR-26-187","published":"2026-10-26T07:00:00.000Z"}],"exploits":[],"score":88,"priority":"urgente","reasons":["Score CVSS pas encore publié","83 % de probabilité d'exploitation sous 30 jours (EPSS)","Exploitée activement (catalogue CISA KEV)","Signalée par CISA"]},{"id":"CVE-2026-48356","published":"2026-10-27","description":"Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["adobe"],"products":["commerce and magento"],"cwes":[],"references":[],"affected":[],"origin":"kev","epss":0.44579,"epssPercentile":0.98769,"kev":{"name":"Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","dateAdded":"2026-10-27","dueDate":"2026-11-10","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."},"ssvc":null,"mentions":[{"source":"CISA","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-27T12:00:00.000Z"}],"exploits":[{"url":"https://github.com/abraxas/CVE-2026-48356","cveId":"CVE-2026-48356","source":"github","title":"abraxas/CVE-2026-48356","description":"CVE-2026-48356 - Magento Open Source - Critical 9.3 - Unauthenticated POST /rest/default/V1/guest-carts/{cartId}/items - Unauthenticated Unrestricted File Upload (PolyShell)","stars":0,"publishedAt":"2026-09-26T02:43:05.000Z","firstSeen":"2026-10-27T21:45:04.146Z"},{"url":"https://github.com/piecar21/CVE-2026-48356","cveId":"CVE-2026-48356","source":"github","title":"piecar21/CVE-2026-48356","description":"PoC / exploit archive for CVE-2026-48356","stars":0,"publishedAt":"2026-10-27T19:52:35.000Z","firstSeen":"2026-10-27T21:45:04.146Z"}],"score":82,"priority":"urgente","reasons":["Score CVSS pas encore publié","45 % de probabilité d'exploitation sous 30 jours (EPSS)","Exploitée activement (catalogue CISA KEV)","2 codes d'exploitation publics","Signalée par CISA"]},{"id":"CVE-2026-97229","published":"2026-10-29","description":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["gitlab"],"products":["community edition and enterprise edition"],"cwes":[],"references":[],"affected":[],"origin":"kev","epss":0.273,"epssPercentile":0.9806,"kev":{"name":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","dateAdded":"2026-10-29","dueDate":"2026-11-01","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."},"ssvc":null,"mentions":[{"source":"CISA","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-29T12:00:00.000Z"}],"exploits":[],"score":78,"priority":"urgente","reasons":["Score CVSS pas encore publié","27 % de probabilité d'exploitation sous 30 jours (EPSS)","Exploitée activement (catalogue CISA KEV)","Signalée par CISA"]},{"id":"CVE-2026-46300","published":"2026-10-28","description":"Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["linux"],"products":["kernel"],"cwes":[],"references":[],"affected":[],"origin":"kev","epss":0.1613,"epssPercentile":0.96928,"kev":{"name":"Linux Kernel Missing Initialization of a Variable Vulnerability","dateAdded":"2026-10-28","dueDate":"2026-10-31","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."},"ssvc":null,"mentions":[{"source":"CISA","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-28T12:00:00.000Z"}],"exploits":[{"url":"https://github.com/0xBlackash/CVE-2026-46300","cveId":"CVE-2026-46300","source":"github","title":"0xBlackash/CVE-2026-46300","description":"CVE-2026-46300","stars":16,"publishedAt":"2026-05-15T15:59:35.000Z","firstSeen":"2026-11-02T09:05:55.365Z"},{"url":"https://github.com/MadExploits/CVE-2026-46300","cveId":"CVE-2026-46300","source":"github","title":"MadExploits/CVE-2026-46300","description":"CVE-2026-43284 - CVE-2026-43500 - CVE-2026-46300 Variant of dirtyfrag exploit","stars":3,"publishedAt":"2026-06-30T18:15:27.000Z","firstSeen":"2026-11-02T09:05:55.365Z"},{"url":"https://github.com/HORKimhab/CVE-2026-46300","cveId":"CVE-2026-46300","source":"github","title":"HORKimhab/CVE-2026-46300","description":"CVE-2026-46300","stars":2,"publishedAt":"2026-05-14T07:17:45.000Z","firstSeen":"2026-11-02T09:05:55.365Z"},{"url":"https://github.com/azilRababe/CVE-2026-46300","cveId":"CVE-2026-46300","source":"github","title":"azilRababe/CVE-2026-46300","description":"Technical analysis of CVE-2026-46300 (Fragnesia), a Linux kernel page-cache write vulnerability that enables local privilege escalation through SKBFL_SHARED_FRAG invariant violations in the networking stack.","stars":2,"publishedAt":"2026-06-22T08:51:07.000Z","firstSeen":"2026-11-02T09:05:55.365Z"},{"url":"https://github.com/Sentebale/CVE-2026-46300","cveId":"CVE-2026-46300","source":"github","title":"Sentebale/CVE-2026-46300","description":"","stars":1,"publishedAt":"2026-05-14T07:27:07.000Z","firstSeen":"2026-11-02T09:05:55.365Z"},{"url":"https://github.com/1neptune/Fragnesia","cveId":"CVE-2026-46300","source":"github","title":"1neptune/Fragnesia","description":"Add go CVE-2026-46300 (Fragnesia) local privilege escalation exploit","stars":1,"publishedAt":"2026-06-03T09:19:26.000Z","firstSeen":"2026-11-02T09:05:55.365Z"},{"url":"https://github.com/ExploitEoom/CVE-2026-46300","cveId":"CVE-2026-46300","source":"github","title":"ExploitEoom/CVE-2026-46300","description":"Linux kernel root exploit","stars":0,"publishedAt":"2026-05-17T09:00:39.000Z","firstSeen":"2026-11-02T09:05:55.365Z"},{"url":"https://github.com/First-John/cve_2026_frag_family_fix","cveId":"CVE-2026-46300","source":"github","title":"First-John/cve_2026_frag_family_fix","description":"CVE-2026-46300 / CVE-2026-43500 / CVE-2026-31431 / CVE-2026-43284 golang hotfix","stars":0,"publishedAt":"2026-05-18T19:32:29.000Z","firstSeen":"2026-11-02T09:05:55.365Z"}],"score":75,"priority":"urgente","reasons":["Score CVSS pas encore publié","16 % de probabilité d'exploitation sous 30 jours (EPSS)","Exploitée activement (catalogue CISA KEV)","16 codes d'exploitation publics","Signalée par CISA"]},{"id":"CVE-2026-120240","published":"2026-11-01T19:16:57.950","description":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","cvss":9.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn553x1-b"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_group_command_injection.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120240","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919251","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429599","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429599/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN553X1-B","ranges":["V260403_2.0.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.01687,"epssPercentile":0.77027,"kev":null,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":73,"priority":"haute","reasons":["Gravité critique (CVSS 9.9)","Code d'exploitation public"]},{"id":"CVE-2026-120279","published":"2026-11-02T01:17:26.677","description":"A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","cvss":10,"cvssVersion":"3.1","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn536ax6-a"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120279","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919788","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429623","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429623/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN536AX6-A","ranges":["V260507"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total"},"mentions":[],"exploits":[],"score":70,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)","Code d'exploitation public"]},{"id":"CVE-2026-111357","published":"2026-10-30","description":"Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["ivanti"],"products":["connect secure"],"cwes":[],"references":[],"affected":[],"origin":"kev","epss":0.00533,"epssPercentile":0.45014,"kev":{"name":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","dateAdded":"2026-10-30","dueDate":"2026-11-02","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."},"ssvc":null,"mentions":[{"source":"CISA","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-30T12:00:00.000Z"}],"exploits":[],"score":67,"priority":"urgente","reasons":["Score CVSS pas encore publié","Exploitée activement (catalogue CISA KEV)","Signalée par CISA"]},{"id":"CVE-2026-76418","published":"2026-10-29","description":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["cisco"],"products":["secure firewall asa software and cisco secure ftd software"],"cwes":[],"references":[],"affected":[],"origin":"kev","epss":0.00821,"epssPercentile":0.57299,"kev":{"name":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability","dateAdded":"2026-10-29","dueDate":"2026-11-01","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."},"ssvc":null,"mentions":[{"source":"CISA","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-29T12:00:00.000Z"},{"source":"Cisco","kind":"editeur","title":"Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability","link":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Secure%20Firewall%20Adaptive%20Security%20Appliance%20and%20Secure%20Firewall%20Threat%20Defense%20Software%20Remote%20Access%20SSL%20VPN%20Tunnel%20Denial%20of%20Service%20Vulnerability%26vs_k=1","published":"2026-10-28T19:15:00.000Z"}],"exploits":[],"score":67,"priority":"urgente","reasons":["Score CVSS pas encore publié","Exploitée activement (catalogue CISA KEV)","Signalée par CISA"]},{"id":"CVE-2026-41709","published":"2026-10-28","description":"Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["broadcom"],"products":["vmware esx"],"cwes":[],"references":[],"affected":[],"origin":"kev","epss":0.00689,"epssPercentile":0.52738,"kev":{"name":"Broadcom VMWare ESX Insufficient Logging Vulnerability","dateAdded":"2026-10-28","dueDate":"2026-11-11","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."},"ssvc":null,"mentions":[{"source":"CISA","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-28T12:00:00.000Z"}],"exploits":[],"score":67,"priority":"urgente","reasons":["Score CVSS pas encore publié","Exploitée activement (catalogue CISA KEV)","Signalée par CISA"]},{"id":"CVE-2026-118527","published":"2026-10-30","description":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["ivanti"],"products":["connect secure"],"cwes":[],"references":[],"affected":[],"origin":"kev","epss":null,"epssPercentile":null,"kev":{"name":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","dateAdded":"2026-10-30","dueDate":"2026-11-13","ransomware":false,"action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines."},"ssvc":null,"mentions":[{"source":"CISA","kind":"gouv","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog","published":"2026-10-30T12:00:00.000Z"}],"exploits":[],"score":65,"priority":"urgente","reasons":["Score CVSS pas encore publié","Exploitée activement (catalogue CISA KEV)","Signalée par CISA"]},{"id":"CVE-2026-120239","published":"2026-11-01T18:17:13.920","description":"A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","cvss":9.9,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn553x1-b"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120239","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919250","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429598","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429598/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN553X1-B","ranges":["V260403_2.0.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.01687,"epssPercentile":0.77028,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":63,"priority":"haute","reasons":["Gravité critique (CVSS 9.9)"]},{"id":"CVE-2026-120238","published":"2026-11-01T18:17:13.720","description":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","cvss":9.9,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn553x1-b"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120238","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919248","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429597","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429597/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN553X1-B","ranges":["260403_2.0.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.01687,"epssPercentile":0.77027,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":63,"priority":"haute","reasons":["Gravité critique (CVSS 9.9)"]},{"id":"CVE-2026-120338","published":"2026-11-01T16:18:14.970","description":"Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).","cvss":10,"cvssVersion":"3.1","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":["prefecthq"],"products":["prefab-ui"],"cwes":["CWE-94","CWE-269","CWE-693"],"references":[{"url":"https://github.com/PrefectHQ/prefab/commit/030f074f85e0b1be0dd44b0283185aecb26337a2","tags":["Correctif"]},{"url":"https://github.com/PrefectHQ/prefab/pull/538","tags":["Correctif"]},{"url":"https://github.com/PrefectHQ/prefab/security/advisories/GHSA-595q-jv4r-q7j9","tags":["Avis éditeur"]},{"url":"https://github.com/PrefectHQ/prefab/releases/tag/v0.21.0","tags":["Notes de version"]},{"url":"https://pypi.org/project/prefab-ui/0.21.0/","tags":["Notes de version"]},{"url":"https://github.com/PrefectHQ/prefab","tags":["Produit"]},{"url":"https://github.com/PrefectHQ/prefab/releases/tag/v0.14.0","tags":["Analyse technique"]},{"url":"https://github.com/PrefectHQ/prefab/releases/tag/v0.20.2","tags":["Analyse technique"]},{"url":"https://pypi.org/project/prefab-ui/","tags":["Produit"]}],"affected":[{"source":"CNA","vendor":"PrefectHQ","product":"prefab-ui","ranges":["0.14.0 → < 0.21.0"],"fixed":["0.21.0"],"platforms":[],"ecosystem":"pypi.org/project/prefab-ui/"}],"origin":"nvd","epss":0.00771,"epssPercentile":0.55672,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":62,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)"]},{"id":"CVE-2026-120345","published":"2026-11-02T06:17:43.410","description":"A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","cvss":10,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_dns_resolution_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120345","tags":[]},{"url":"https://vuldb.com/submit/919579","tags":[]},{"url":"https://vuldb.com/vuln/429670","tags":[]},{"url":"https://vuldb.com/vuln/429670/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":60,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)"]},{"id":"CVE-2026-120344","published":"2026-11-02T05:18:25.450","description":"A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","cvss":10,"cvssVersion":"3.1","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_wireguard_cli_group_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120344","tags":[]},{"url":"https://vuldb.com/submit/919551","tags":[]},{"url":"https://vuldb.com/vuln/429669","tags":[]},{"url":"https://vuldb.com/vuln/429669/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":60,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)"]},{"id":"CVE-2026-120283","published":"2026-11-02T01:17:27.500","description":"A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":10,"cvssVersion":"3.1","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":["linksys"],"products":["e8450"],"cwes":["CWE-119","CWE-121"],"references":[{"url":"https://vuldb.com/cve/CVE-2026-120283","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1014924","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429627","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429627/cti","tags":["Signature","Accès restreint"]},{"url":"https://www.linksys.com/","tags":["Produit"]}],"affected":[{"source":"CNA","vendor":"Linksys","product":"E8450","ranges":["1.2.00.360516"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total"},"mentions":[],"exploits":[],"score":60,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)"]},{"id":"CVE-2026-120281","published":"2026-11-02T01:17:27.070","description":"A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","cvss":10,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn536ax6-a"],"cwes":["CWE-119","CWE-121"],"references":[{"url":"https://github.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120281","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919790","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429625","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429625/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN536AX6-A","ranges":["V260507"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":60,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)"]},{"id":"CVE-2026-120280","published":"2026-11-02T01:17:26.873","description":"A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","cvss":10,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn536ax6-a"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_group_id.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120280","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919789","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429624","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429624/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN536AX6-A","ranges":["V260507"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":60,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)"]},{"id":"CVE-2026-120277","published":"2026-11-02T00:18:10.810","description":"A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","cvss":10,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn536ax6-a"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_wireguard_cli_group_command_injection.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120277","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919503","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429621","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429621/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN536AX6-A","ranges":["V260507_2.0.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":60,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)"]},{"id":"CVE-2026-120276","published":"2026-11-02T00:18:09.897","description":"A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","cvss":10,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn536ax6-a"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_openvpn_cli_group_command_injection.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120276","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919502","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429620","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429620/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN536AX6-A","ranges":["V260507_2.0.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":60,"priority":"haute","reasons":["Gravité critique (CVSS 10.0)"]},{"id":"CVE-2026-73697","published":"2026-11-02T15:17:37.660","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution.","cvss":9.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-22","CWE-78"],"references":[{"url":"https://control-webpanel.com/changelog","tags":[]},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-73697 - Control Web Panel (CWP) < 1.16 File Write and Command Injection","link":"https://cvefeed.io/vuln/detail/CVE-2026-73697","published":"2026-11-02T14:53:27.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.8)"]},{"id":"CVE-2026-73696","published":"2026-11-02T15:17:37.480","description":"Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access.","cvss":9.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-698"],"references":[{"url":"https://control-webpanel.com/changelog","tags":[]},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-authentication-bypass-via-execution-after-redirect","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-73696 - Control Web Panel (CWP) < 1.12 Authentication Bypass via Execution After Redirect","link":"https://cvefeed.io/vuln/detail/CVE-2026-73696","published":"2026-11-02T14:52:29.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.8)"]},{"id":"CVE-2026-73695","published":"2026-11-02T15:17:37.287","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion.","cvss":9.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-98"],"references":[{"url":"https://control-webpanel.com/changelog","tags":[]},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-lfi-via-module-parameter","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-73695 - Control Web Panel (CWP) < 1.16 Path Traversal LFI via module Parameter","link":"https://cvefeed.io/vuln/detail/CVE-2026-73695","published":"2026-11-02T14:51:47.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.8)"]},{"id":"CVE-2026-120442","published":"2026-11-02T15:17:26.490","description":"ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.","cvss":9.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-1394"],"references":[{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/issues/36","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery","tags":[]},{"url":"https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.8)"]},{"id":"CVE-2026-120322","published":"2026-11-02T02:18:47.550","description":"A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":9.9,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendors":["termix-ssh"],"products":["termix"],"cwes":["CWE-22"],"references":[{"url":"https://github.com/0xGenesi/CVE/blob/main/Termix_FileManager_transferToHost_Arbitrary_File_Write.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120322","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015028","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429654","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429654/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"Termix-SSH","product":"Termix","ranges":["2.9.0","2.9.1","2.9.2"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.9)"]},{"id":"CVE-2026-120282","published":"2026-11-02T01:17:27.293","description":"A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","cvss":9.9,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","vendors":["wavlink"],"products":["wn536ax6-a"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120282","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919791","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429626","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429626/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN536AX6-A","ranges":["V260507"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.9)"]},{"id":"CVE-2026-118312","published":"2026-10-27T23:03:20.918Z","description":"Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/540025369","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00307,"epssPercentile":0.23552,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118312 Memory corruption in Paint","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118312","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-118308","published":"2026-10-27T23:03:18.858Z","description":"Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574791952","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00307,"epssPercentile":0.23551,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118308 Use after free in SVG","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118308","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-118310","published":"2026-10-27T23:03:18.388Z","description":"Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574516887","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00307,"epssPercentile":0.23551,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118310 Improper input validation in Views","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118310","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-118342","published":"2026-10-27T23:03:18.174Z","description":"Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-787"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574412629","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00295,"epssPercentile":0.22169,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118342 Out of bounds write in Editing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118342","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-118316","published":"2026-10-27T23:03:17.720Z","description":"Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574223268","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00295,"epssPercentile":0.2217,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118316 Improper input validation in V8","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118316","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-118332","published":"2026-10-27T23:03:16.794Z","description":"Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574030524","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00295,"epssPercentile":0.2217,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118332 Improper input validation in Compositing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118332","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-118340","published":"2026-10-27T23:03:12.611Z","description":"Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/568936530","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00354,"epssPercentile":0.29129,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118340 Memory corruption in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118340","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-118305","published":"2026-10-27T23:03:11.199Z","description":"Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/568348290","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00369,"epssPercentile":0.30745,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118305 Memory corruption in Turbolev","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118305","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-118306","published":"2026-10-27T23:03:08.662Z","description":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":9.6,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/571156746","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00369,"epssPercentile":0.30745,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118306 Memory corruption in FileSystem","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118306","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":59,"priority":"haute","reasons":["Gravité critique (CVSS 9.6)"]},{"id":"CVE-2026-62048","published":"2026-11-01T16:18:15.170","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.","cvss":9.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","vendors":["liquid web / stellarwp"],"products":["bookit"],"cwes":["CWE-89"],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-6-0-6-sql-injection-vulnerability?_s_id=cve","tags":["Base de vulnérabilités"]}],"affected":[{"source":"CNA","vendor":"Liquid Web / StellarWP","product":"BookIt","ranges":["≤ 2.6.0.6"],"fixed":[],"platforms":[],"ecosystem":"wordpress.org/plugins"}],"origin":"nvd","epss":0.00342,"epssPercentile":0.27711,"kev":null,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":57,"priority":"haute","reasons":["Gravité critique (CVSS 9.3)"]},{"id":"CVE-2026-120446","published":"2026-11-02T15:17:27.323","description":"madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.","cvss":9.4,"cvssVersion":"3.1","cvssSource":"NVD","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-306"],"references":[{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/controller/tenant/AccountController.php#L26","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/config/middleware.php","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/issues/2","tags":[]},{"url":"https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120446 - madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API","link":"https://cvefeed.io/vuln/detail/CVE-2026-120446","published":"2026-11-02T14:29:06.000Z"}],"exploits":[],"score":56,"priority":"haute","reasons":["Gravité critique (CVSS 9.4)"]},{"id":"CVE-2026-116606","published":"2026-11-02T13:17:37.017","description":"An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.","cvss":9.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-288"],"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","tags":[]},{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":56,"priority":"haute","reasons":["Gravité critique (CVSS 9.3)"]},{"id":"CVE-2025-11969","published":"2026-11-02T06:17:42.087","description":"The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.","cvss":9.4,"cvssVersion":"3.1","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","vendors":[],"products":[],"cwes":["CWE-285"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":56,"priority":"haute","reasons":["Gravité critique (CVSS 9.4)"]},{"id":"CVE-2026-120213","published":"2026-11-02T11:17:31.137","description":"@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.","cvss":9.1,"cvssVersion":"3.1","cvssSource":"CNA","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","vendors":[],"products":[],"cwes":["CWE-22","CWE-436"],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","tags":[]},{"url":"https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":55,"priority":"haute","reasons":["Gravité critique (CVSS 9.1)"]},{"id":"CVE-2026-120313","published":"2026-11-02T03:17:29.053","description":"Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendors":["jovancoding"],"products":["network-ai"],"cwes":["CWE-22"],"references":[{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-5mm5-4mh4-6gm6","tags":["Avis éditeur","Exploit"]},{"url":"https://www.vulncheck.com/advisories/network-ai-before-5.15.5-path-traversal-via-inputsanitizer-sanitizepath","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"Jovancoding","product":"Network-AI","ranges":["< 5.15.5"],"fixed":["5.15.5"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":55,"priority":"haute","reasons":["Gravité élevée (CVSS 7.5)","Code d'exploitation public"]},{"id":"CVE-2026-118338","published":"2026-10-27T23:03:21.158Z","description":"Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/575826638","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.18352,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118338 Use after free in Animation","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118338","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118315","published":"2026-10-27T23:03:20.026Z","description":"Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/575184164","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.18353,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118315 Improper input validation in SVG","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118315","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118330","published":"2026-10-27T23:03:19.788Z","description":"Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/575090745","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00334,"epssPercentile":0.26801,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118330 Use after free in Browser","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118330","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118341","published":"2026-10-27T23:03:19.541Z","description":"Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574911701","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.1835,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118341 Use after free in Modularization","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118341","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118347","published":"2026-10-27T23:03:19.320Z","description":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574911589","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.18352,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118347 Use after free in FileSystem","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118347","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118335","published":"2026-10-27T23:03:18.612Z","description":"Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574606539","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.18351,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118335 Improper input validation in Metrics","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118335","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118346","published":"2026-10-27T23:03:17.935Z","description":"Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574382050","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.18351,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118346 Use after free in Compositing","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118346","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118304","published":"2026-10-27T23:03:17.508Z","description":"Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574101376","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00275,"epssPercentile":0.19949,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118304 Improper input validation in SVG","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118304","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118345","published":"2026-10-27T23:03:17.254Z","description":"Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574061024","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.1835,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118345 Use after free in PDFium","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118345","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118313","published":"2026-10-27T23:03:17.021Z","description":"Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574032795","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00275,"epssPercentile":0.19948,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118313 Use after free in Video","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118313","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118334","published":"2026-10-27T23:03:16.569Z","description":"Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574027204","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.18351,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118334 Use after free in ImageCapture","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118334","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118311","published":"2026-10-27T23:03:16.341Z","description":"Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/573938968","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00275,"epssPercentile":0.19949,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118311 Memory corruption in Media","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118311","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118343","published":"2026-10-27T23:03:16.113Z","description":"Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/573389782","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.1835,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118343 Improper input validation in ReadingList","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118343","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118327","published":"2026-10-27T23:03:15.662Z","description":"Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/572878518","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00275,"epssPercentile":0.19949,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118327 Memory corruption in Media","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118327","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118349","published":"2026-10-27T23:03:15.427Z","description":"Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/572422506","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.18352,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118349 Memory corruption in Payments","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118349","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118336","published":"2026-10-27T23:03:14.746Z","description":"Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/572111820","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00317,"epssPercentile":0.24644,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118336 Improper input validation in Headless","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118336","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118328","published":"2026-10-27T23:03:14.278Z","description":"Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/570927027","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00401,"epssPercentile":0.34364,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118328 Improper input validation in WebRTC","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118328","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118307","published":"2026-10-27T23:03:13.760Z","description":"Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/570675085","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.0033,"epssPercentile":0.26188,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118307 Use after free in Paint","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118307","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118329","published":"2026-10-27T23:03:12.181Z","description":"Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/568900535","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00388,"epssPercentile":0.32886,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118329 Improper input validation in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118329","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118320","published":"2026-10-27T23:03:11.628Z","description":"Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/568894515","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00317,"epssPercentile":0.24645,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118320 Memory corruption in V8","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118320","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118317","published":"2026-10-27T23:03:11.418Z","description":"Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/568730797","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00317,"epssPercentile":0.24644,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118317 Memory corruption in HTML","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118317","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118339","published":"2026-10-27T23:03:10.980Z","description":"Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/567645136","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00317,"epssPercentile":0.24644,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118339 Use after free in Animation","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118339","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118350","published":"2026-10-27T23:03:10.539Z","description":"Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/567129324","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00264,"epssPercentile":0.1835,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118350 Use after free in Turbolev","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118350","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118344","published":"2026-10-27T23:03:09.848Z","description":"Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-416"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574852698","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.0034,"epssPercentile":0.27505,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118344 Use after free in Layout","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118344","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118348","published":"2026-10-27T23:03:09.516Z","description":"Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/574776938","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.0034,"epssPercentile":0.27505,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118348 Improper input validation in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118348","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-118331","published":"2026-10-27T23:03:09.097Z","description":"Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":["google"],"products":["chrome"],"cwes":["CWE-20"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/572193211","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.0034,"epssPercentile":0.27505,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118331 Improper input validation in FileAPI","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118331","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":54,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-120461","published":"2026-11-02T15:17:30.247","description":"Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.","cvss":8.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-639"],"references":[{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/CommandInfoController.java#L176-L184","tags":[]},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/service/node/ssh/SshCommandService.java#L167-L169","tags":[]},{"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","tags":[]},{"url":"https://github.com/dromara/Jpom/issues/120","tags":[]},{"url":"https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-node-ssh-command-batch","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120461 - Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch","link":"https://cvefeed.io/vuln/detail/CVE-2026-120461","published":"2026-11-02T14:29:17.000Z"}],"exploits":[],"score":53,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-120460","published":"2026-11-02T15:17:30.053","description":"Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.","cvss":8.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-639"],"references":[{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51","tags":[]},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51","tags":[]},{"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","tags":[]},{"url":"https://github.com/dromara/Jpom/issues/119","tags":[]},{"url":"https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllers","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120460 - Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers","link":"https://cvefeed.io/vuln/detail/CVE-2026-120460","published":"2026-11-02T14:29:16.000Z"}],"exploits":[],"score":53,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-120445","published":"2026-11-02T15:17:27.107","description":"madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.","cvss":8.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-863"],"references":[{"url":"https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/middleware/AccessTokenMiddleware.php#L62-L73","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","tags":[]},{"url":"https://github.com/madong-code/madong-admin-saas/issues/2","tags":[]},{"url":"https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-incorrect-authorization-via-platformapi-accesstokenmiddleware","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120445 - madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware","link":"https://cvefeed.io/vuln/detail/CVE-2026-120445","published":"2026-11-02T14:29:05.000Z"}],"exploits":[],"score":53,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-102802","published":"2026-11-02T14:17:34.057","description":"Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue.","cvss":8.9,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-94"],"references":[{"url":"https://www.regularlabs.com/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":53,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.9)"]},{"id":"CVE-2026-18199","published":"2026-11-02T08:17:36.083","description":"Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.","cvss":8.8,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-78"],"references":[{"url":"https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-18199.html","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":53,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-120315","published":"2026-11-02T03:17:29.457","description":"LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.","cvss":8.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":["lobehub"],"products":["chat"],"cwes":["CWE-22"],"references":[{"url":"https://github.com/lobehub/lobehub/security/advisories/GHSA-2g9j-v25c-4j97","tags":["Avis éditeur"]},{"url":"https://www.vulncheck.com/advisories/lobehub-chat-1.84.26-before-2.1.49-path-traversal-rce-via-writetempfile","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"lobehub","product":"chat","ranges":["1.84.26 → < 2.1.49"],"fixed":["2.1.49"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":53,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-120312","published":"2026-11-02T03:17:28.863","description":"Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.","cvss":8.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":["jovancoding"],"products":["network-ai"],"cwes":["CWE-23"],"references":[{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mfxv-jg44-xj48","tags":["Avis éditeur"]},{"url":"https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-agentvcr-cassette-name","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"Jovancoding","product":"Network-AI","ranges":["5.13.4 → < 5.15.5"],"fixed":["5.15.5"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":53,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-120311","published":"2026-11-02T03:17:28.663","description":"Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.","cvss":8.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":["jovancoding"],"products":["network-ai"],"cwes":["CWE-23"],"references":[{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-v64j-mc7x-c7x7","tags":["Avis éditeur"]},{"url":"https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-filejobstore-job-id","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"Jovancoding","product":"Network-AI","ranges":["5.13.4 → < 5.15.5"],"fixed":["5.15.5"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":53,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.8)"]},{"id":"CVE-2026-105602","published":"2026-11-02T14:17:34.813","description":"Joomla Extension - joomshaper.com -  Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.","cvss":8.6,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://www.joomshaper.com/joomla-templates/helixultimate","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":52,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.6)"]},{"id":"CVE-2026-105600","published":"2026-11-02T14:17:34.520","description":"Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5","cvss":8.6,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-94"],"references":[{"url":"https://www.php-web-design.com/Information/stageit-6-changelog.html","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":52,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.6)"]},{"id":"CVE-2026-103419","published":"2026-11-02T14:17:34.210","description":"Joomla Extension - joomshaper.com -  Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.","cvss":8.6,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://www.joomshaper.com/joomla-templates/helixultimate","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":52,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.6)"]},{"id":"CVE-2026-111560","published":"2026-11-02T13:17:35.190","description":"Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.","cvss":8.6,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-78"],"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md","tags":[]},{"url":"https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":52,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.6)"]},{"id":"CVE-2026-8923","published":"2026-11-02T11:17:33.380","description":"Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.","cvss":8.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","vendors":[],"products":[],"cwes":["CWE-78"],"references":[{"url":"https://www.manageengine.com/products/eventlog/advisory/CVE-2026-8923.html","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":52,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.7)"]},{"id":"CVE-2026-2613","published":"2026-11-02T11:17:31.963","description":"The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.\n\nA user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.","cvss":8.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-89"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":52,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.7)"]},{"id":"CVE-2026-120324","published":"2026-11-02T03:17:30.157","description":"A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.","cvss":8.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","vendors":["aklivity"],"products":["zilla"],"cwes":["CWE-22"],"references":[{"url":"https://github.com/aklivity/zilla/commit/46a8b15cbea157f7ae8b7cb865809a02fd6b1988","tags":["Correctif"]},{"url":"https://github.com/aklivity/zilla/pull/2623","tags":["Suivi de bug","Correctif"]},{"url":"https://github.com/aklivity/zilla/releases/tag/2.5.0-rc3","tags":["Correctif"]},{"url":"https://github.com/0xGenesi/CVE/blob/main/Zilla_Http_Filesystem_Binding_Path_Traversal.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120324","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015032","tags":["Avis tiers"]},{"url":"https://github.com/aklivity/zilla/","tags":["Produit"]},{"url":"https://vuldb.com/vuln/429656","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429656/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"Aklivity","product":"Zilla","ranges":["1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.5.0-rc1"],"fixed":["2.5.0-rc3"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":50,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.3)"]},{"id":"CVE-2026-84170","published":"2026-11-01T23:17:29.913","description":"Allocation of resources without limits or throttling in Apache Wicket.\n\norg.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected files to a separately mounted resource rather than through a Form. The resource is an application-wide singleton with no component to consult, so newResourceResponse() takes the three limits that bound the upload - the total request size, the maximum size of a single part and the maximum number of parts - from the request parameters maxSize, fileMaxSize and fileCountMax, and hands them to the multipart parser as they arrive. Nothing binds those numbers to the field that is supposed to be uploading. A request naming a very large maxSize is therefore parsed with no effective ceiling on the total size, and omitting fileMaxSize and fileCountMax leaves the per-part and part-count limits unset as well. The values the application configured through FileUploadToResourceField#setMaxSize(), #setFileMaxSize() and #setFileCountMax() are consulted only when the client omits the corresponding parameter, so against a client that supplies one they have no effect at all.\n\nParts above the parser's in-memory threshold are spooled to the container's temporary directory, and the file parts are then copied into the folder the application's IUploadsFileManager owns, under a sub-folder the request names, where they remain. A part that is not a file is read into the heap in full while the request is parsed. One request, repeatable, can therefore consume as much disk or as much heap as the client chooses to send. The resource carries no authorization annotation and the default authorization strategy permits every resource request, so unless the application authorizes the resource itself the request needs no authentication, no session, no prior page view and no user interaction.\n\nAn application is affected where it uses FileUploadToResourceField, or mounts FileUploadResourceReference itself. This is not the ordinary upload path: the resource is a singleton that has to be created and mounted deliberately. An application that configures no upload limit at all loses nothing, because Wicket applies no total-size limit of its own by default; what the defect removes is a limit the application set. Uploads through Form with FileUploadField, and through AjaxFileDropBehavior, are not affected, because both read their limits from the component rather than from the request. The upload resource does not exist in the 8.x line.\n\nThis issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.9.1. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.","cvss":8.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-770"],"references":[{"url":"https://lists.apache.org/thread.html/bw3hn5cch3q7yrsl05m8mvmgyx4m98y7","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["9.14.0 → 9.24.0","10.0.0 → 10.9.1"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":50,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.3)"]},{"id":"CVE-2026-83594","published":"2026-11-01T23:17:29.723","description":"Memory allocation with an excessive size value in Apache Wicket.\n\norg.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over its own Ajax callback. That callback reads the request parameter filesInfo, a JSON array carrying a client file name, a size and a content type for each file, and turns it into the list of FileUploadToResourceField.UploadInfo that onUploadSuccess() receives. Nothing binds that JSON to an upload the resource performed and nothing re-derives it from the stored files, so the number of entries and every value in them are whatever the request supplied. The callback URL is rendered into the page, no prior upload is required, and both GET and POST reach it, so any client that can load the page can have the component report files that were never uploaded, without authenticating beyond whatever the page itself requires and without any user interaction.\n\nUploadInfo#get(), which the class offers as the way to obtain the bytes of an upload, allocates a byte array from UploadInfo#getSize() before it opens the file. The array is therefore sized by the number the request supplied, and the allocation happens even for a file that was never stored. One small request can cost the server close to two gigabytes of heap, and the request is trivially repeatable, so a few of them exhaust the heap for every request the Java virtual machine is serving. A size that the conversion to int turns negative instead throws NegativeArraySizeException, which the exception handler inside that method does not cover, so it escapes into the application.\n\nAn application is affected where it uses FileUploadToResourceField, which is not the ordinary upload path through FileUploadField and Form and has to be extended and mounted deliberately. The allocation additionally requires the application to call UploadInfo#get() rather than reading UploadInfo#getFile() itself. Where the application denies the ENABLE action on the field through its authorization strategy, the callback is refused like any other listener. The 8.x line does not contain this component and is not affected.\n\nThis issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.","cvss":8.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-789"],"references":[{"url":"https://lists.apache.org/thread.html/h5lxspxg746pzjd437n3n7mq5t3sfbcb","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["9.14.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":50,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.3)"]},{"id":"CVE-2026-120448","published":"2026-11-02T15:17:27.737","description":"DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.","cvss":8.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","vendors":[],"products":[],"cwes":["CWE-915"],"references":[{"url":"https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js","tags":[]},{"url":"https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0","tags":[]},{"url":"https://vul.yulun.ac.cn/20261102/doracms/","tags":[]},{"url":"https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120448 - DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint","link":"https://cvefeed.io/vuln/detail/CVE-2026-120448","published":"2026-11-02T14:29:07.000Z"}],"exploits":[],"score":49,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.1)"]},{"id":"CVE-2026-120447","published":"2026-11-02T15:17:27.523","description":"HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.","cvss":8.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-287"],"references":[{"url":"https://github.com/bufanyun/hotgo/blob/269b2f9e435cf8ff6b18d53bc053a905f4e02d11/server/internal/logic/sys/sms_log.go","tags":[]},{"url":"https://github.com/bufanyun/hotgo/blob/269b2f9e435cf8ff6b18d53bc053a905f4e02d11/server/internal/model/input/sysin/sms_log.go","tags":[]},{"url":"https://github.com/bufanyun/hotgo/commit/cb57056c746650e6ff86dec1e97d404b63dcfd30","tags":[]},{"url":"https://github.com/bufanyun/hotgo/issues/240","tags":[]},{"url":"https://vul.yulun.ac.cn/20261102/hotgo/","tags":[]},{"url":"https://www.vulncheck.com/advisories/hotgo-through-2.15.1-authentication-bypass-via-client-set-sms-verification-code","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120447 - HotGo through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code","link":"https://cvefeed.io/vuln/detail/CVE-2026-120447","published":"2026-11-02T14:29:06.000Z"}],"exploits":[],"score":49,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.1)"]},{"id":"CVE-2026-120444","published":"2026-11-02T15:17:26.917","description":"GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.","cvss":8.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-22"],"references":[{"url":"https://github.com/sea-team/gofound/blob/v1.4.1/searcher/container.go","tags":[]},{"url":"https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go","tags":[]},{"url":"https://github.com/sea-team/gofound/issues/101","tags":[]},{"url":"https://vul.yulun.ac.cn/20261102/gofound/","tags":[]},{"url":"https://www.vulncheck.com/advisories/gofound-through-1.4.1-path-traversal-via-database-parameter-in-api-db-drop","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":49,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.1)"]},{"id":"CVE-2026-117518","published":"2026-11-02T11:17:30.660","description":"@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.","cvss":8.2,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-22"],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","tags":[]},{"url":"https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-vp2r-3vgv-32g9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":49,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.2)"]},{"id":"CVE-2026-120236","published":"2026-11-01T17:16:33.393","description":"A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 660182b973a44b8eda5484b14b88eb9cc251edc4. It is suggested to upgrade the affected component.","cvss":6.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","vendors":["ag-ui-protocol"],"products":["ag-ui"],"cwes":["CWE-20"],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/commit/660182b973a44b8eda5484b14b88eb9cc251edc4","tags":["Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2774","tags":["Suivi de bug","Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-10-30","tags":["Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2524","tags":["Exploit","Suivi de bug"]},{"url":"https://vuldb.com/cve/CVE-2026-120236","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015178","tags":["Avis tiers"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/","tags":["Produit"]},{"url":"https://vuldb.com/vuln/429595","tags":["Base de vulnérabilités"]},{"url":"https://vuldb.com/vuln/429595/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"ag-ui-protocol","product":"ag-ui","ranges":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.00267,"epssPercentile":0.18822,"kev":null,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":49,"priority":"moyenne","reasons":["Code d'exploitation public"]},{"id":"CVE-2026-94349","published":"2026-11-02T13:17:41.583","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.","cvss":8,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-78"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":48,"priority":"moyenne","reasons":["Gravité élevée (CVSS 8.0)"]},{"id":"CVE-2026-120438","published":"2026-11-02T15:17:25.767","description":"QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.","cvss":7.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-190"],"references":[{"url":"https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p","tags":[]},{"url":"https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.8)"]},{"id":"CVE-2026-120436","published":"2026-11-02T15:17:25.440","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.","cvss":7.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-190"],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5324/","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5323/trunk/converter/other/jbig/jbigtopnm.c","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","tags":[]},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-via-jbigtopnm","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.8)"]},{"id":"CVE-2026-120435","published":"2026-11-02T15:17:25.277","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.","cvss":7.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5336/","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5335/trunk/converter/ppm/xpmtoppm.c","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","tags":[]},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-in-xpmtoppm","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.8)"]},{"id":"CVE-2026-120434","published":"2026-11-02T15:17:25.113","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.","cvss":7.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-121"],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5331/","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5330/trunk/converter/ppm/picttoppm.c","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","tags":[]},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-overflow-via-scanpoly","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.8)"]},{"id":"CVE-2026-120433","published":"2026-11-02T15:17:24.940","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.","cvss":7.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-121"],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5328/","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5327/trunk/converter/ppm/picttoppm.c","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","tags":[]},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-buffer-overflow-via-paintpoly","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.8)"]},{"id":"CVE-2026-120432","published":"2026-11-02T15:17:24.750","description":"Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row buffer indices to cause crashes or potential code execution.","cvss":7.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-190"],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5335/","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5334/trunk/converter/other/winicontopam.c","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","tags":[]},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-integer-overflow-in-winicontopam","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.8)"]},{"id":"CVE-2026-120431","published":"2026-11-02T15:17:24.573","description":"Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.","cvss":7.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-122"],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5317/","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5316/trunk/converter/other/sgitopnm.c","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5318/advanced/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5319/stable/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","tags":[]},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.29-and-11.15.07-sgitopnm-heap-buffer-overflow","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.8)"]},{"id":"CVE-2026-92886","published":"2026-11-02T13:17:41.250","description":"Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation.\n\nThis issue affects eta-register: from 2.0.8 before 2.0.9.","cvss":7.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-862"],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1440","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.8)"]},{"id":"CVE-2026-120241","published":"2026-11-01T19:16:59.393","description":"A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":["ruijie"],"products":["rg-es205gc","rg-es206gc-p","rg-es208gc","rg-es210gc-lp","rg-es210gs-p"],"cwes":["CWE-119","CWE-120"],"references":[{"url":"https://github.com/byseeker/Ruijie-RG-ES-Series-Switches_PreAuth_Boundary_Overflow_DoS","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120241","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1016041","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429600","tags":["Base de vulnérabilités"]},{"url":"https://vuldb.com/vuln/429600/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"Ruijie","product":"RG-ES205GC","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]},{"source":"CNA","vendor":"Ruijie","product":"RG-ES206GC-P","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]},{"source":"CNA","vendor":"Ruijie","product":"RG-ES208GC","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]},{"source":"CNA","vendor":"Ruijie","product":"RG-ES210GC-LP","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]},{"source":"CNA","vendor":"Ruijie","product":"RG-ES210GS-P","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.00619,"epssPercentile":0.49657,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":47,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-95863","published":"2026-11-01T23:17:30.943","description":"Improper neutralization of input during web page generation in Apache Wicket.\n\nApache Wicket generates JavaScript that refers to the elements it renders, and\nwrites into that JavaScript two values it derives itself: a component's markup\nid, and the input name of a form component, which is built from component ids.\nBoth are placed inside single-quoted JavaScript string literals without being\nescaped for that context, so a value containing a single quote or a backslash\nends the literal, and what follows is parsed as script and runs in the\napplication's origin when the page loads.\n\nA markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),\nor the id attribute written in the component's markup, or an id Wicket\ngenerates, in that order. The first two are supplied by the application in an\nHTML context, where both characters are legal and where Wicket escapes them\ncorrectly when it writes the same value into the id attribute of the element; a\ngenerated id cannot contain either. An input name is derived from the ids of the\ncomponents between the form and the form component, and a component id was\nrejected only for ':' and '~'.\n\nIn org.apache.wicket:wicket-core on 9.x and 10.x,\norg.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,\nCharSequence) quotes the id it is given into a Wicket.Event.add call, and\ncomponents in both wicket-core and wicket-extensions reach it through\n#forComponent(Component, String, CharSequence). On every affected version,\norg.apache.wicket.markup.html.form.Form writes its markup id and the id of its\nhidden-fields container into such literals,\norg.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input\nname, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes\ntwo markup ids and an input name. On 8.x, Form also writes an input name into the\naction of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField\nwrites an input name into a name attribute with no escaping at all, so a value\ncontaining a double quote escapes the attribute into markup.\n\norg.apache.wicket:wicket-extensions is affected in its own right and not only\nthrough wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,\nAjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,\nFilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build\ntheir own JavaScript containing a markup id.\n\nAn application is affected where a markup id or a component id carries one of\nthose characters. Wicket does not put one there itself, so the value comes from\nthe application: an id set on a component, an id attribute in a template, or a\ncomponent id derived from data. None of those is a JavaScript context from the\napplication's point of view.\n\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does\nnot prevent this. The generated script is written into a script element carrying\nthe per-response nonce, so the injected code is part of a script the policy\nadmits.\n\nThe fixed versions check an id where it enters instead of escaping each place it\nis written. A component id and a markup id may no longer contain a quote, a\nbackquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a\ncontrol character, and a markup id may not contain parentheses or square\nbrackets either; a component constructed with such an id, or given such a markup\nid, fails with an exception.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through\n9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which\nare no longer supported, should upgrade to a supported version. Users are\nrecommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":7.6,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-79"],"references":[{"url":"https://lists.apache.org/thread.html/5wg754b873tlnsc268myrwcoy9lt046v","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":46,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.6)"]},{"id":"CVE-2026-82956","published":"2026-11-01T23:17:29.130","description":"Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.name, which reaches the server as the request parameter windowName, and remembers what the browser reported in a field of the behaviour. That field is part of the page's serialized state, so the remembered value stays in the page store for as long as the page instance does.\n\nOn every later render of that page instance the behaviour builds the precondition of its Ajax call by substituting the remembered value into a single-quoted JavaScript string literal, and Wicket writes that precondition into the page as raw JavaScript, because the precondition of an Ajax call listener is script supplied by the caller and is emitted without quoting or escaping. Nothing on that path escapes the value. The window name is client-supplied and Wicket applies no validation to it, so a remembered name containing a single quote ends the literal and the rest of it runs as script in the application's origin, every time that page instance is rendered.\n\nAn application is affected only where it has explicitly added AjaxNewWindowNotifyingBehavior to a component. No part of the framework installs the behaviour, so an application that does not use it is not affected. The name the behaviour generates for itself, when the browser reports no name at all, is a random UUID and is not client-supplied.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0.\n\nUsers are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":7.6,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-79"],"references":[{"url":"https://lists.apache.org/thread.html/fs3vdddt9bwshdstj952psj49s5w4vqm","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":46,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.6)"]},{"id":"CVE-2026-111089","published":"2026-11-01T23:17:28.697","description":"Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values without being escaped for that context, so a text containing a quote ends the literal or the attribute, and what follows is parsed as script or as markup in the application's origin when the page loads.\n\nA resource bundle entry is authored for the application and does not say where the framework will write it. The same key is read by the framework into element text, where Wicket escapes it, and into the contexts below, where it did not. A text containing an apostrophe, which is ordinary in several languages, is enough to break the page; a text under the influence of another party is enough to run script.\n\nIn org.apache.wicket:wicket-core, org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes the org.apache.wicket.mfu.delete message into a JavaScript string literal, and org.apache.wicket.markup.html.form.Form writes the hidden-fields css class into the class attribute of the container it renders for its hidden fields; on 8.0.0 through 8.19.0 and 9.0.0 through 9.24.0 Form#appendDefaultButtonField writes the same css class into a second container. In org.apache.wicket:wicket-extensions, UploadProgressBar writes its UploadProgressBar.starting text into a JavaScript string literal, FilterForm writes the hidden-fields css class into the class attribute of its hidden input markup, and on 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 TrapFocusBehavior writes its current css class into a JavaScript string literal.\n\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent the JavaScript cases: the generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy admits. It does prevent an inline event handler injected through the attribute cases.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":7.6,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-79"],"references":[{"url":"https://lists.apache.org/thread.html/xyp4sm5mm7s618fktstb22577qxbmqw8","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":46,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.6)"]},{"id":"CVE-2026-120426","published":"2026-11-02T15:17:23.583","description":"OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, to read files in private model, code or space repositories.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-639"],"references":[{"url":"https://github.com/OpenCSGs/csghub-server/blob/v2.6.0-ce/api/middleware/authenticator.go#L210-L226","tags":[]},{"url":"https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/internal/handlers/frontend/resolve.go#L138-L151","tags":[]},{"url":"https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/internal/routes/router.go#L302-L303","tags":[]},{"url":"https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/pkg/server/backend/csghubserver/download.go#L10-L41","tags":[]},{"url":"https://github.com/OpenCSGs/csghub/issues/1586","tags":[]},{"url":"https://github.com/OpenCSGs/csghub/releases/tag/v2.6.0-ce","tags":[]},{"url":"https://hackmd.io/@hieund/csghub-private-repo-file-read-idor","tags":[]},{"url":"https://www.vulncheck.com/advisories/opencsg-csghub-through-2.6.0-ce-unauthenticated-private-repository-file-read-via-resolve-route","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-74993","published":"2026-11-02T14:17:37.953","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection.\n\nThis issue affects Inventory Tracking Application: through 2026-10-16.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-89"],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1441","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-101186","published":"2026-11-02T07:18:03.617","description":"DoS vulnerability in the window module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-19"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20557","published":"2026-11-02T03:17:32.823","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01877236; Issue ID: MSV-9804.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT6813","MT6815","MT6835","MT6858","MT6878","MT6881","MT6897","MT6899","MT6982","MT6986","MT6988","MT6991","MT6993"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20556","published":"2026-11-02T03:17:32.697","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6813","MT6815","MT6833","MT6835","MT6853","MT6855","MT6858","MT6873","MT6875","MT6877","MT6878"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20554","published":"2026-11-02T03:17:32.427","description":"In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01911177; Issue ID: MSV-10122.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6739","MT6761","MT6762","MT6763","MT6765","MT6767","MT6768","MT6769","MT6771","MT6779","MT6781"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20549","published":"2026-11-02T03:17:31.780","description":"In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775865; Issue ID: MSV-8895.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6739","MT6761","MT6762","MT6763","MT6765","MT6767","MT6768","MT6769","MT6771","MT6779","MT6781"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20548","published":"2026-11-02T03:17:31.650","description":"In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6739","MT6761","MT6762","MT6763","MT6765","MT6767","MT6768","MT6769","MT6771","MT6779","MT6781"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20547","published":"2026-11-02T03:17:31.523","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01874018 / MOLY01774038; Issue ID: MSV-9802.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6739","MT6761","MT6762","MT6763","MT6765","MT6767","MT6768","MT6769","MT6771","MT6779","MT6781"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20546","published":"2026-11-02T03:17:31.390","description":"In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6739","MT6761","MT6762","MT6763","MT6765","MT6767","MT6768","MT6769","MT6771","MT6779","MT6781"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20545","published":"2026-11-02T03:17:31.257","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6739","MT6761","MT6762","MT6763","MT6765","MT6767","MT6768","MT6769","MT6771","MT6779","MT6781"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-20499","published":"2026-11-02T03:17:31.090","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247.","cvss":7.5,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6739","MT6761","MT6762","MT6763","MT6765","MT6767","MT6768","MT6769","MT6771","MT6779","MT6781"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.5)"]},{"id":"CVE-2026-120317","published":"2026-11-02T03:17:29.957","description":"http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.","cvss":5.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","vendors":["http4k"],"products":["http4k"],"cwes":["CWE-345"],"references":[{"url":"https://github.com/http4k/http4k/security/advisories/GHSA-9xx4-xjpj-xqcf","tags":["Avis éditeur","Exploit"]},{"url":"https://www.vulncheck.com/advisories/http4k-4.9.10.0-before-6.60.0.0-digest-auth-int-missing-body-integrity","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"http4k","product":"http4k","ranges":["4.9.10.0 → < 6.60.0.0"],"fixed":["6.60.0.0"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":45,"priority":"moyenne","reasons":["Code d'exploitation public"]},{"id":"CVE-2026-120459","published":"2026-11-02T15:17:29.867","description":"python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.","cvss":7.4,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","vendors":[],"products":[],"cwes":["CWE-347"],"references":[{"url":"https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/cryptography_backend.py","tags":[]},{"url":"https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/native.py","tags":[]},{"url":"https://github.com/mpdavis/python-jose/issues/398","tags":[]},{"url":"https://www.vulncheck.com/advisories/python-jose-through-3.5.0-authentication-bypass-via-empty-hmac-key","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120459 - python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key","link":"https://cvefeed.io/vuln/detail/CVE-2026-120459","published":"2026-11-02T14:29:15.000Z"}],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.4)"]},{"id":"CVE-2026-120349","published":"2026-11-02T07:18:03.843","description":"A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":7.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-74","CWE-94"],"references":[{"url":"https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120349","tags":[]},{"url":"https://vuldb.com/submit/1016299","tags":[]},{"url":"https://vuldb.com/vuln/429673","tags":[]},{"url":"https://vuldb.com/vuln/429673/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.3)"]},{"id":"CVE-2026-120348","published":"2026-11-02T06:17:43.787","description":"A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":7.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-74","CWE-94"],"references":[{"url":"https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120348","tags":[]},{"url":"https://vuldb.com/submit/1016298","tags":[]},{"url":"https://vuldb.com/vuln/429672","tags":[]},{"url":"https://vuldb.com/vuln/429672/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.3)"]},{"id":"CVE-2026-120347","published":"2026-11-02T06:17:43.600","description":"A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.","cvss":7.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-74","CWE-89"],"references":[{"url":"https://gitee.com/dayrui/xunruicms/","tags":[]},{"url":"https://gitee.com/dayrui/xunruicms/commit/9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231","tags":[]},{"url":"https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/3.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120347","tags":[]},{"url":"https://vuldb.com/submit/1016284","tags":[]},{"url":"https://vuldb.com/vuln/429671","tags":[]},{"url":"https://vuldb.com/vuln/429671/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.3)"]},{"id":"CVE-2026-120342","published":"2026-11-02T05:18:24.310","description":"A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":7.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-74","CWE-89"],"references":[{"url":"https://github.com/luan-oliveira01/Advisory-CloudClassroom-PHP-Project-1.0/tree/main/viewquery-sqli","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120342","tags":[]},{"url":"https://vuldb.com/submit/1016422","tags":[]},{"url":"https://vuldb.com/vuln/429667","tags":[]},{"url":"https://vuldb.com/vuln/429667/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.3)"]},{"id":"CVE-2026-120341","published":"2026-11-02T05:18:23.700","description":"A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project. Impacted is an unknown function of the file studentdetails.php. The manipulation leads to execution after redirect. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":7.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-698","CWE-705"],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/details-plaintext-disclosure.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120341","tags":[]},{"url":"https://vuldb.com/submit/1016328","tags":[]},{"url":"https://vuldb.com/vuln/429666","tags":[]},{"url":"https://vuldb.com/vuln/429666/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.3)"]},{"id":"CVE-2026-120337","published":"2026-11-02T04:16:53.237","description":"A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":7.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-119","CWE-416"],"references":[{"url":"https://gist.github.com/Ishanoshada/cb73d61f792c77767338568501b135c9","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120337","tags":[]},{"url":"https://vuldb.com/submit/1016302","tags":[]},{"url":"https://vuldb.com/vuln/429662","tags":[]},{"url":"https://vuldb.com/vuln/429662/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.3)"]},{"id":"CVE-2026-120336","published":"2026-11-02T04:16:53.033","description":"A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":7.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-119","CWE-121"],"references":[{"url":"https://gist.github.com/Ishanoshada/f6345a42a46e1345e6c7400aac311d77","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120336","tags":[]},{"url":"https://vuldb.com/submit/1016301","tags":[]},{"url":"https://vuldb.com/vuln/429661","tags":[]},{"url":"https://vuldb.com/vuln/429661/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.3)"]},{"id":"CVE-2026-120314","published":"2026-11-02T03:17:29.260","description":"Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.","cvss":7.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":["jovancoding"],"products":["network-ai"],"cwes":["CWE-306"],"references":[{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qvf5-9prv-7r9c","tags":["Avis éditeur"]},{"url":"https://www.vulncheck.com/advisories/network-ai-5.14.0-before-5.15.5-missing-authentication-in-a2aserver-task-operations","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"Jovancoding","product":"Network-AI","ranges":["5.14.0 → < 5.15.5"],"fixed":["5.15.5"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.3)"]},{"id":"CVE-2026-84231","published":"2026-11-01T23:17:30.550","description":"Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is not an a, link or area element. The URL held in the component's model is concatenated into a single-quoted JavaScript string literal in that handler without being escaped for that context. The same happens on the neighbouring branch, taken when popup settings are attached, where the value is concatenated into the window.open() call built by org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only escaping applied is the markup escaping that every attribute value receives as the tag is written, which replaces an apostrophe with a character reference. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin.\n\nAn application is affected where it binds an ExternalLink to a markup tag that is not an anchor, such as a button or a span, and the URL in the model holds data an attacker can influence, which is the ordinary use of the component rather than a misuse of it. Nothing runs until a user activates the element.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.\n\nUsers are recommended to upgrade to version 8.20.0, which fixes the issue.","cvss":7.4,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-79"],"references":[{"url":"https://lists.apache.org/thread.html/39kz9838w25797bpkxn1hvfsm8jtc4zv","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.4)"]},{"id":"CVE-2026-83559","published":"2026-11-01T23:17:29.513","description":"Improper encoding or escaping of output in Apache Wicket.\n\norg.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote, so that the value can be placed inside a JavaScript string literal. It does not escape the backslash, which is the character that has to be escaped, and escaped first, for the rest of that escaping to hold. A value that already holds a backslash immediately before a quote therefore ends up with two backslashes in front of that quote: the first escapes the second, the quote itself is left unescaped, and it closes the literal. Whatever the value carries after that point is no longer text but JavaScript, and it runs in the application's origin and in the session of the user looking at the page. The method is public, is not deprecated, and its documentation states that its result can be part of a JavaScript call such as an alert; the only limitation it notes concerns JSON values, which need different escaping.\n\nAn application is affected wherever it calls the method itself and places the result inside a JavaScript string literal, from its own code or from a component of its own or of a third party, and the value it escapes holds data an attacker can influence. There is no further condition, and no component of Wicket has to be involved: the application is using the method for what its documentation offers, and the method does not deliver it.\n\nTwo components shipped with Wicket Extensions pass a value through the method. org.apache.wicket.extensions.ajax.markup.html.AjaxEditableLabel writes the editor's first error feedback message into a single-quoted JavaScript string literal in the Ajax response, so an application is affected through that component where the message shown for a failed edit holds data an attacker can influence, whether that is the submitted value itself or another variable the application sets on the validation error. A validation message can carry the submitted value, because input is a message variable that every form component supplies for its own validation errors, and the documentation shows overriding a validator's message to include it; none of the message bundles shipped with Wicket interpolates it, so an application that has not written such a message is not affected through this component. org.apache.wicket.extensions.ajax.markup.html.repeater.AjaxListPanel passes the serialized markup tag of an appended component through the method and is not affected: the tag comes from the panel's own markup file, and a quote in any of its attribute values, the component's markup id included, is written as a character reference by the tag serialization and cannot close the literal.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.\n\nUsers are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":7.4,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-116"],"references":[{"url":"https://lists.apache.org/thread.html/77kc85ztkxdpp7wg7cv61c4539j9s1g3","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.4)"]},{"id":"CVE-2026-83539","published":"2026-11-01T23:17:29.317","description":"Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escape the model value and then hand the escaped text to org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser, which searches it for anything of the form scheme://rest and wraps each match in an anchor whose href is the matched text, copied in as it is. The pattern accepts any scheme, and there is no list of permitted schemes anywhere on the path. A text value naming a scheme that executes script therefore becomes an anchor that executes it, in the application's origin and in the reader's own session, when the reader clicks the link. Rendering the page is not enough on its own; the link has to be activated. Escaping does not prevent this and is not the issue: the characters the payload needs are all valid in a URL and are ones that org.apache.wicket.util.string.Strings#escapeMarkup() leaves alone, and the value ends up in a URL rather than in element text, which is a context that escaping model data does not make safe.\n\nAn application is affected where it renders text it received through either of these two components. That is what they are for: they exist to linkify email addresses and web URLs found in the data an application is displaying, so untrusted input is the purpose of the feature rather than a misuse of it, and no unusual configuration is involved. No other component uses this parser, and an application that uses neither SmartLinkLabel nor SmartLinkMultiLineLabel is not affected.\n\nOn 9.x and 10.x the Content-Security-Policy Wicket sends by default admits script only from a source carrying a per-response nonce, and a URL whose scheme executes script cannot carry one, so that default policy stops the script from running. This is a property of the default policy and not of these components. An application that has weakened or disabled its Content-Security-Policy, for this or for any unrelated reason, is affected in full. Wicket 8.x has no Content-Security-Policy support at all and is affected as it stands.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":7.4,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-79"],"references":[{"url":"https://lists.apache.org/thread.html/xqdymd8g178sc112lmqbp53zlss53cwz","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.4)"]},{"id":"CVE-2026-66570","published":"2026-11-01T16:18:15.323","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.","cvss":7.1,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","vendors":["nickboss"],"products":["wordpress file upload"],"cwes":["CWE-79"],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerability/wordpress-wordpress-file-upload-plugin-5-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve","tags":["Base de vulnérabilités"]}],"affected":[{"source":"CNA","vendor":"Nickboss","product":"WordPress File Upload","ranges":["≤ 5.2.1"],"fixed":[],"platforms":[],"ecosystem":"wordpress.org/plugins"}],"origin":"nvd","epss":0.00201,"epssPercentile":0.09978,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":44,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.1)"]},{"id":"CVE-2026-120487","published":"2026-11-02T15:17:30.467","description":"LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.","cvss":7.2,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-863"],"references":[{"url":"https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4","tags":[]},{"url":"https://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120487 - LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades","link":"https://cvefeed.io/vuln/detail/CVE-2026-120487","published":"2026-11-02T14:29:17.000Z"}],"exploits":[],"score":43,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.2)"]},{"id":"CVE-2026-120429","published":"2026-11-02T15:17:24.190","description":"Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.","cvss":7.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-862"],"references":[{"url":"https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/controllers/camaleon_cms/admin/media_controller.rb","tags":[]},{"url":"https://github.com/owen2345/camaleon-cms/commit/7fe4fa0bf99256dfe32b5f674baf4f771606549e","tags":[]},{"url":"https://github.com/owen2345/camaleon-cms/pull/1147","tags":[]},{"url":"https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2","tags":[]},{"url":"https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-missing-authorization-via-admin-mediacontroller","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":43,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.1)"]},{"id":"CVE-2026-120318","published":"2026-11-02T15:17:22.303","description":"Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.","cvss":7.2,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-862"],"references":[{"url":"https://downloads.wordpress.org/plugin/woo-product-gallery-slider.2.3.26.zip","tags":[]},{"url":"https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.25/includes/codestar/functions/actions.php","tags":[]},{"url":"https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.25/src/Options.php","tags":[]},{"url":"https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.26/includes/cdx-framework/functions/actions.php","tags":[]},{"url":"https://wordpress.org/plugins/woo-product-gallery-slider/#developers","tags":[]},{"url":"https://www.vulncheck.com/advisories/product-gallery-slider-for-woocommerce-2.3.23-before-2.3.26-missing-authorization-via-codestar-ajax","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":43,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.2)"]},{"id":"CVE-2026-103420","published":"2026-11-02T14:17:34.363","description":"Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5","cvss":7.2,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-352"],"references":[{"url":"https://www.php-web-design.com/Information/stageit-6-changelog.html","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":43,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.2)"]},{"id":"CVE-2026-101176","published":"2026-11-02T07:18:02.577","description":"Permission control vulnerability in the event notification management module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.","cvss":7.1,"cvssVersion":"3.1","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-264"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":43,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.1)"]},{"id":"CVE-2026-82840","published":"2026-11-01T22:17:48.017","description":"Session fixation in Apache Wicket.\n\norg.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) method is the entry point through which an application authenticates a session. Renewing the container session id at that point is the standard defence against an attacker who has fixed a session id in a victim's browser, and Wicket provides that renewal as org.apache.wicket.Session#changeSessionId(), whose documentation directs callers to invoke it on login for exactly that reason.\n\nAuthenticatedWebSession#signIn(String, String) calls it inside a guard that succeeds only on the first transition of the session's signed-in flag. The session id is therefore renewed when a session first signs in, and is not renewed when a session that is already signed in authenticates again. signIn(String, String) returns true either way, so neither the caller nor the application can tell that the renewal did not happen.\n\nAn application is affected where it authenticates through AuthenticatedWebSession, which AuthenticatedWebApplication requires and which the shipped UsernamePasswordPanel uses, and where a session that is already signed in can authenticate again: a step-up prompt before a sensitive action, an account switch, or simply a sign-in form that stays reachable once the user is signed in. Nothing in the module hides that form from a signed-in session. Reaching the defect also requires an attacker to place a session id of their choosing in the victim's browser. JSESSIONID is set by the servlet container rather than by Wicket, so that needs a position Wicket does not grant, such as control of a host under the same registrable domain or a container configured to carry the session id in the URL, and the planted session has to be one the attacker has already signed in on, because a session that is not yet signed in does have its id renewed by the victim's authentication. An authentication attempt that fails signs the session out and closes the window. Applications that renew the session id in their own code after a successful authentication are not affected.\n\nAs a workaround, renew the session id from the application's own code on every successful authentication, by calling Session#changeSessionId() at the end of the authenticate(String, String) implementation.\n\nThis issue affects Apache Wicket: from 8.18.0 through 8.19.0, from 9.23.0 through 9.24.0, from 10.9.0 through 10.11.0.\n\nUsers are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":7.2,"cvssVersion":"4.0","cvssSource":"CNA","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-384"],"references":[{"url":"https://lists.apache.org/thread.html/q812kjb74x2pt6956w0pcmkc4wwj95l9","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.18.0 → 8.19.0","9.23.0 → 9.24.0","10.9.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":43,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.2)"]},{"id":"CVE-2026-120439","published":"2026-11-02T15:17:25.937","description":"QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.","cvss":7,"cvssVersion":"3.1","cvssSource":"NVD","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","vendors":[],"products":[],"cwes":["CWE-190"],"references":[{"url":"https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L60032","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-9wv5-5cgr-grj6","tags":[]},{"url":"https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-typedarray-prototype-sort","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":42,"priority":"moyenne","reasons":["Gravité élevée (CVSS 7.0)"]},{"id":"CVE-2026-120451","published":"2026-11-02T15:17:28.357","description":"libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.","cvss":6.8,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://github.com/gphoto/libgphoto2/blob/v2.5.34/camlibs/jl2005c/jl2005c.c#L138-L154","tags":[]},{"url":"https://github.com/gphoto/libgphoto2/commit/6a3393dd996502457ab965432cf0b2035278825e","tags":[]},{"url":"https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442","tags":[]},{"url":"https://github.com/gphoto/libgphoto2/issues/1326","tags":[]},{"url":"https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow","tags":[]},{"url":"https://www.vulncheck.com/advisories/libgphoto2-through-2.5.34-buffer-overflow-via-jl2005c-camera-driver","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120451 - libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver","link":"https://cvefeed.io/vuln/detail/CVE-2026-120451","published":"2026-11-02T14:29:09.000Z"}],"exploits":[],"score":41,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-118052","published":"2026-11-02T15:17:16.883","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.","cvss":6.8,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-667","CWE-833"],"references":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-67ww-q8x2-g487","tags":[]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/511","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":41,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-91907","published":"2026-11-02T13:17:40.347","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering","cvss":6.8,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":41,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-82704","published":"2026-11-01T22:17:47.583","description":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.core.request.handler.ListenerRequestHandler invokes an IRequestListener only when org.apache.wicket.Component#canCallListener() allows it, and that method is isEnabledInHierarchy() && isVisibleInHierarchy(). The visibility half reads a flag that carries the outcome of IAuthorizationStrategy#isActionAuthorized() for the Component.RENDER action, and that flag is written in one place only, Component#configure(), during the render phase. A listener URL built by a subclass of org.apache.wicket.core.request.mapper.AbstractBookmarkableMapper carries the page identifier and the component path in a single parameter, and the page identifier may be empty. When it is, a new page instance is constructed, PageProvider#wasExpired() is false because no identifier was supplied, and PageAndComponentProvider#getComponent() finds the component directly on the new instance, so neither a render pass nor Component#configure() runs before the listener is invoked. The flag therefore still holds its constructor default, the component counts as visible, and the listener of a component the authorization strategy denied RENDER for is executed. The same request also skips Component#onConfigure(), so visibility and enablement an application sets there are not applied either.\n\nThere are two ways to reach this, and neither requires anything but a request. On a page that is stateful, the caller omits the page identifier from a listener URL that would otherwise carry it. On a page that Wicket considers stateless, nothing has to be altered at all: Wicket itself writes listener URLs without a page identifier for such pages, and a component the strategy denies RENDER for is treated as stateless and therefore does not keep the page stateful, so denying RENDER can itself produce the page-id-less form. The second route has never been refused. The ENABLE decision of IAuthorizationStrategy is consulted on every invocation and still refuses, as does a request that supplies the real identifier of a page instance that has already been rendered; a component the application disabled in Component#onConfigure() is protected by neither, because that callback has not run.\n\nAn application is affected where it withholds an individual component from the caller, either by denying the RENDER action through IAuthorizationStrategy, including through the MetaDataRoleAuthorizationStrategy and AuthorizeAction facilities of wicket-auth-roles, or by setting the component's visibility or enabled flag in Component#onConfigure(), the callback Wicket's own documentation directs applications to use for both. The page carrying such a component has to be constructible from a bookmarkable or mounted URL, which requires a public constructor taking either no arguments or a PageParameters argument. Behaviours pass through the same gate, so an AJAX behaviour attached to such a component is equally exposed. Separately, and whether or not any component is withheld, a listener on a page Wicket considers stateful is invoked on an instance the request itself constructed, so it acts on models built from page parameters the caller supplied rather than on the state the application last rendered. Instantiation authorization is unaffected: IAuthorizationStrategy#isInstantiationAuthorized() is still consulted when the new page instance is created, so a guard placed on the page rather than on the individual component continues to hold.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":6.9,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-862"],"references":[{"url":"https://lists.apache.org/thread.html/yrtov7vfmj7c7wl7j1tt0dsv2t0zwy9b","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":41,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-82557","published":"2026-11-01T22:17:46.990","description":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in Form#onRequest() and passes the result directly to Form#onFormSubmitted(IFormSubmitter). The check that the submitting component is visible and enabled in its hierarchy runs only when onFormSubmitted() is given no submitter, so it no longer runs for an ordinary form submission, and it is the only point at which Wicket verifies that the application actually offered the named control to the caller. Form#findSubmitter() matches on the request parameter name alone and applies no visibility or enablement filter, and the request handler checks only the form itself, which is visible and enabled. A request that names a submit button the application withheld therefore reaches that button's onSubmit() and onAfterSubmit(), and its onError() when form validation fails; where the button sets setDefaultFormProcessing(false) it reaches onSubmit() and onAfterSubmit() without any form validation.\n\nAn application is affected where a form submitting component, such as a Button or a SubmitLink, is unavailable to the caller while the enclosing form remains available. How the component was made unavailable does not matter: the component's own setVisible(false), setEnabled(false) or setVisibilityAllowed(false), an overridden isVisible() or isEnabled(), an invisible or disabled parent container anywhere above it, and a RENDER or ENABLE denial from IAuthorizationStrategy — for example through MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation — are all enforced by that one check, and all of them are bypassed. A component that renders as disabled carries its own input name in the markup the caller already holds. Submissions made through AjaxFormSubmitBehavior, and therefore through AjaxButton and AjaxSubmitLink, are not affected: those are invoked as a behaviour on the button itself, the behaviour's invocation is authorized against that button, and the non-Ajax callbacks of those two classes do nothing. Restrictions applied to the form or to the page rather than to the submitting component are unaffected.\n\nThe 9.x and 8.x release lines, and the unsupported lines before them, are not affected; the behaviour was introduced in 10.3.0.\n\nThis issue affects Apache Wicket: from 10.3.0 through 10.11.0. Users are recommended to upgrade to version 10.12.0, which fixes the issue.","cvss":6.9,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-862"],"references":[{"url":"https://lists.apache.org/thread.html/lz4jot6f9ycxfjyhmlr2b4ssynmgpy92","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["10.3.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":41,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-119480","published":"2026-11-01T16:18:13.513","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.","cvss":6.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendors":["crocoblock"],"products":["jetformbuilder"],"cwes":["CWE-22"],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-7-1-arbitrary-file-deletion-vulnerability?_s_id=cve","tags":["Base de vulnérabilités"]}],"affected":[{"source":"CNA","vendor":"Crocoblock","product":"JetFormBuilder","ranges":["≤ 3.6.7.1"],"fixed":[],"platforms":[],"ecosystem":"wordpress.org/plugins"}],"origin":"nvd","epss":0.00405,"epssPercentile":0.34744,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":41,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-101178","published":"2026-11-02T08:17:34.237","description":"Permission control vulnerability in the autofill service module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.","cvss":6.6,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-200"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":40,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-68591","published":"2026-11-02T03:17:38.343","description":"In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958.","cvss":6.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-732"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":40,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-68589","published":"2026-11-02T03:17:38.087","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889.","cvss":6.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":40,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-20599","published":"2026-11-02T03:17:37.657","description":"In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148.","cvss":6.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-280"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":40,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120425","published":"2026-11-02T15:17:23.407","description":"Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.","cvss":6.5,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-639"],"references":[{"url":"https://github.com/munafio/chatify/blob/v1.6.3/src/ChatifyMessenger.php#L101-L124","tags":[]},{"url":"https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a","tags":[]},{"url":"https://github.com/munafio/chatify/issues/412","tags":[]},{"url":"https://github.com/munafio/chatify/releases/tag/v1.6.4","tags":[]},{"url":"https://hackmd.io/@hieund/chatify-pusher-channel-authorization-bypass","tags":[]},{"url":"https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":39,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120463","published":"2026-11-02T14:17:36.773","description":"Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the `other` document type. Attackers can exploit insufficient authorization checks in the `paperless_search_and_link()` and `serve_paperless_document()` route handlers in file_routes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss.","cvss":6.5,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-862"],"references":[{"url":"https://github.com/sassanix/Warracker/releases/tag/1.0.4","tags":[]},{"url":"https://github.com/sassanix/Warracker/security/advisories/GHSA-3h89-rqfj-5674","tags":[]},{"url":"https://www.vulncheck.com/advisories/warracker-before-missing-authorization-via-paperless-ngx-document-linking","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":39,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-118871","published":"2026-11-02T10:17:11.123","description":"SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.","cvss":6.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-89"],"references":[{"url":"https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031803240","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":39,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-101173","published":"2026-11-02T07:18:02.137","description":"DoS vulnerability in the DSoftBus module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":6.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-400"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":39,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120335","published":"2026-11-02T03:17:30.873","description":"A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","cvss":4.8,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","vendors":["deepset-ai"],"products":["farm"],"cwes":["CWE-22"],"references":[{"url":"https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_FARM_WordEmbedding_LM_Model_Package_Loading.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120335","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1016279","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429660","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429660/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"deepset-ai","product":"farm","ranges":["0.1","0.2","0.3","0.4","0.5","0.6","0.7","0.8.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":39,"priority":"moyenne","reasons":["Code d'exploitation public"]},{"id":"CVE-2026-91905","published":"2026-11-02T13:17:40.020","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.","cvss":6.4,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-347"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":38,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120325","published":"2026-11-02T03:17:30.410","description":"A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":6.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","vendors":["webpro-nl"],"products":["knip"],"cwes":["CWE-22"],"references":[{"url":"https://github.com/0xGenesi/CVE/blob/main/Knip_Workspaces_Config_Path_Traversal_File_Deletion_Overwrite.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120325","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015033","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429657","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429657/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"Webpro-nl","product":"Knip","ranges":["6.0","6.1","6.2","6.3","6.4","6.5","6.6","6.7","6.8","6.9","6.10","6.11","6.12","6.13"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":38,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120319","published":"2026-11-02T02:18:47.090","description":"A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":6.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","vendors":["sanluan"],"products":["publiccms"],"cwes":["CWE-285","CWE-639"],"references":[{"url":"https://vuldb.com/cve/CVE-2026-120319","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1016201","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429652","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429652/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"Sanluan","product":"PublicCMS","ranges":["4.*","5.*","6.*"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":38,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-84177","published":"2026-11-01T23:17:30.317","description":"Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it.\n\norg.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the request URL, and then hands that same path to the resource stream locator together with a style, a variation and a locale. Those three attributes are decoded from the name of the first query parameter and never appear in the string the guard was given. org.apache.wicket.core.util.resource.locator.ResourceNameIterator appends them to that path, each preceded by an underscore, in the order variation, style, locale, before the file extension, so the file that is opened is not the file the guard approved.\n\norg.apache.wicket.markup.html.PackageResourceGuard decides whether an HTML file is a component's markup template by looking for a class file of the same name beside it, stripping one underscore-delimited suffix at a time as it goes. HTML is on the default allow list, so that check is the only thing separating a static HTML file, which may be served, from a markup template, which may not. Asked about the name of a template, the guard refuses it correctly. Asked about a shorter name for which no class exists, it accepts, and a style supplied in the URL then completes that name into the markup template of a component class, which is written to the response.\n\nAn application is affected if the simple name of any of its component classes contains an underscore and no shorter part of that name is itself a class, such as Report_v2 or Wizard_Step1; an application with no such class name is not affected. No unusual deployment, packaging or configuration is required, and running in deployment rather than development mode does not prevent it. Java naming conventions discourage underscores in class names and no module Wicket ships has one, so no framework markup is exposed; what an application exposes this way is its own. A component whose class name has no underscore is not reachable, and neither is its localized or styled markup, because the guard finds the class file under the base name and refuses the request. The attributes cannot change the file extension and cannot leave the component's package, so nothing beyond HTML files in that package is reachable. Access is read-only, and what is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. No user data, credential or session material is reachable this way. An attacker has to name a class in the target package and the component itself, and Wicket writes fully qualified class names into the URL of every package resource it renders.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":6.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-179"],"references":[{"url":"https://lists.apache.org/thread.html/hy089v60t5v36skpnbry96vr2427lw0o","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":38,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-84172","published":"2026-11-01T23:17:30.113","description":"Files accessible to external parties in Apache Wicket.\n\norg.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be served, from a component's markup template, which may not, is a check for a class file of the same name beside it. That check calls getResource() on the class loader that loaded wicket-core. The resource itself is reached through different class loaders: the scope class is resolved through the application's IClassResolver, which uses the thread context class loader, and org.apache.wicket.core.util.resource.ClassPathResourceFinder#find() then tries the scope class' own loader, the context class loader, and the wicket-core loader last.\n\nWhere wicket-core is loaded by a class loader that cannot see the application's classes, the check finds no class file, concludes the file is not a component markup template, and serves it. A request for the package resource URL of a component class then returns that component's markup template with status 200. What is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. Access is read-only, and no user data, credential or session material is reachable this way.\n\nSuch a deployment is rare. The ordinary packaging, a web archive with wicket-core in WEB-INF/lib, puts the framework and the application in one class loader, so the check finds the class file and the template is refused; those deployments are not affected. The exposure is confined to deployments that give wicket-core a class loader which cannot see the application's component classes: wicket-core placed in a servlet container's shared library directory, in an enterprise archive library directory with the application in the web archive, as an application server global module, or as an OSGi bundle, where wicket-core's bundle cannot resolve a class held by an application bundle. Markup shipped by Wicket's own modules, and by any other code sharing a class loader with wicket-core, remains protected. An attacker has to name a component class, and Wicket writes fully qualified class names into the URL of every package resource it renders.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":6.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-552"],"references":[{"url":"https://lists.apache.org/thread.html/90mlx42q7nkdccdby1ql1ksl4sxy13x6","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":38,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-82705","published":"2026-11-01T22:17:47.820","description":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized(), and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource reached through a mounted or shared ResourceReference. Components that are handed an org.apache.wicket.request.resource.IResource instance instead call IResource#respond() themselves from their own request listener and never construct that handler. In wicket-core these are org.apache.wicket.markup.html.link.ResourceLink, org.apache.wicket.markup.html.image.Image and org.apache.wicket.markup.html.form.ImageButton; in wicket-extensions it is org.apache.wicket.extensions.ajax.AjaxDownloadBehavior. A resource restricted by a custom isResourceAuthorized() implementation, or by an @AuthorizeResource annotation from wicket-auth-roles, is therefore enforced when it is requested through its own resource URL and is not enforced when the same instance is served through the component that holds it.\n\nWhich of the two happens is decided by the constructor the application used, and not by anything the application can see in the rendered page. ResourceLink(String, ResourceReference) renders a resource URL and the request is authorized; ResourceLink(String, IResource) renders a component listener URL and it is not. Image, ImageButton and AjaxDownloadBehavior each offer the same pair of constructors and behave the same way. Image and ImageButton write that listener URL into the src attribute of the tag they render, so a browser requests it without any action by the user, and the resource an Image serves may also come from the component's model.\n\nAn application is affected where it restricts a resource through IAuthorizationStrategy#isResourceAuthorized() or an @AuthorizeResource annotation and then hands that same resource to one of those components as an IResource. An application that does not restrict resources at all is not affected, and neither is a resource that is only mounted or registered as a shared resource. The pattern does not have to be written by the application itself: org.apache.wicket.extensions.markup.html.repeater.data.table.export.ExportToolbar builds each of its export links from an IResource instance, so the exported contents of a data table are served without the resource check in any application that adds that toolbar.\n\nAs a workaround, register the resource in the application's shared resources and pass the resulting ResourceReference to the component instead of the IResource, so that the request is routed through the handler that consults the authorization strategy.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":6.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-862"],"references":[{"url":"https://lists.apache.org/thread.html/t9y3sho3wkqkr1vsf74xn8tzmgdr1tgo","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":38,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-82115","published":"2026-11-01T22:17:46.777","description":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client's handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect.\n\nA caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource's callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller's own connection.\n\nAn application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource's callbacks do with a text or binary message of the caller's choosing. The connection is registered under the caller's own session, so it gives no access to another user's connection.\n\nAs a workaround, reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter(), or repeat the authorization check at the start of each callback.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 7.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":6.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-862"],"references":[{"url":"https://lists.apache.org/thread.html/0lj9og7vp22ps77nrwdj42f64cfb9g4c","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":38,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120456","published":"2026-11-02T15:17:29.293","description":"L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.","cvss":6.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://github.com/l-smash/l-smash/blob/v2.14.5/core/read.c#L688-L717","tags":[]},{"url":"https://github.com/l-smash/l-smash/blob/v2.14.5/core/read.c#L853-L876","tags":[]},{"url":"https://github.com/l-smash/l-smash/commit/805ee3c9632e054198d3cb5b09c7b7aa36cdd791","tags":[]},{"url":"https://github.com/l-smash/l-smash/issues/112","tags":[]},{"url":"https://hackmd.io/@haindpwn/lsmash-hdlr-dref-box-size-oob-write","tags":[]},{"url":"https://www.vulncheck.com/advisories/l-smash-through-2.14.5-heap-out-of-bounds-write-via-hdlr-and-url-boxes","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120456 - L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes","link":"https://cvefeed.io/vuln/detail/CVE-2026-120456","published":"2026-11-02T14:29:13.000Z"}],"exploits":[],"score":37,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120455","published":"2026-11-02T15:17:29.117","description":"rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overflow the fixed two-element annotation array in release builds, corrupting stack memory and crashing the process.","cvss":6.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L4307-L4351","tags":[]},{"url":"https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.def.hpp#L5524-L5535","tags":[]},{"url":"https://github.com/biojppm/rapidyaml/blob/v0.16.0/src/c4/yml/parse_engine.hpp#L249-L260","tags":[]},{"url":"https://github.com/biojppm/rapidyaml/issues/680","tags":[]},{"url":"https://github.com/biojppm/rapidyaml/releases/tag/v0.16.0","tags":[]},{"url":"https://hackmd.io/@haindpwn/rapidyaml-parser-annotation-oob-write","tags":[]},{"url":"https://www.vulncheck.com/advisories/rapidyaml-through-0.16.0-out-of-bounds-write-via-parseengine-add-annotation","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120455 - rapidyaml through 0.16.0 Out-of-Bounds Write via ParseEngine::_add_annotation()","link":"https://cvefeed.io/vuln/detail/CVE-2026-120455","published":"2026-11-02T14:29:12.000Z"}],"exploits":[],"score":37,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120443","published":"2026-11-02T15:17:26.693","description":"GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.","cvss":6.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go","tags":[]},{"url":"https://github.com/sea-team/gofound/blob/v1.4.1/web/admin/assets/web/src/views/dashboard.vue","tags":[]},{"url":"https://github.com/sea-team/gofound/issues/101","tags":[]},{"url":"https://vul.yulun.ac.cn/20261102/gofound/","tags":[]},{"url":"https://www.vulncheck.com/advisories/gofound-through-1.4.1-stored-xss-via-admin-dashboard-search-results","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":37,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120437","published":"2026-11-02T15:17:25.603","description":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.","cvss":6.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-125"],"references":[{"url":"https://sourceforge.net/p/netpbm/code/5334/","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5333/trunk/converter/ppm/tgatoppm.c","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","tags":[]},{"url":"https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","tags":[]},{"url":"https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-out-of-bounds-read-via-tgatoppm","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":37,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120428","published":"2026-11-02T15:17:24.010","description":"PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.","cvss":6.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/handler/share/common.go","tags":[]},{"url":"https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/usecase/file.go","tags":[]},{"url":"https://github.com/chaitin/PandaWiki/blob/v3.87.5/web/admin/server.conf","tags":[]},{"url":"https://github.com/chaitin/PandaWiki/issues/1845","tags":[]},{"url":"https://vul.yulun.ac.cn/20261101/pandawiki/","tags":[]},{"url":"https://www.vulncheck.com/advisories/pandawiki-3.65.0-through-3.87.5-stored-xss-via-static-file-pdf-query-string-bypass","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":37,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-91911","published":"2026-11-02T13:17:40.943","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.","cvss":6.1,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-22"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":37,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-91903","published":"2026-11-02T13:17:39.703","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.","cvss":6.1,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-22"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":37,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-101172","published":"2026-11-02T07:18:01.973","description":"Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.","cvss":6.2,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-264"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":37,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120323","published":"2026-11-02T02:18:47.757","description":"A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","vendors":["samanhappy"],"products":["mcphub"],"cwes":["CWE-200","CWE-284"],"references":[{"url":"https://github.com/samanhappy/mcphub/commit/040f7b9ae004070bdfe5084cde6bc2c609f78e76","tags":["Correctif"]},{"url":"https://github.com/samanhappy/mcphub/releases/tag/v1.1.8","tags":["Correctif"]},{"url":"https://github.com/0xGenesi/CVE/blob/main/MCPHub_OpenAPI_passthroughHeaders_Credential_Exfiltration.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120323","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015029","tags":["Avis tiers"]},{"url":"https://github.com/samanhappy/mcphub/","tags":["Produit"]},{"url":"https://vuldb.com/vuln/429655","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429655/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"samanhappy","product":"MCPHub","ranges":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.0.10","1.0.11","1.0.12","1.0.13"],"fixed":["1.1.8"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":36,"priority":"moyenne","reasons":["Code d'exploitation public"]},{"id":"CVE-2026-120216","published":"2026-11-02T11:17:31.553","description":"fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.","cvss":5.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-248"],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","tags":[]},{"url":"https://github.com/fastify/fastify/security/advisories/GHSA-3qgw-9275-xf8w","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":35,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120214","published":"2026-11-02T11:17:31.277","description":"@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.","cvss":5.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-22"],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","tags":[]},{"url":"https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-hr26-gmr2-pwcv","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":35,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-117531","published":"2026-11-02T11:17:30.853","description":"@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.","cvss":5.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-400"],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","tags":[]},{"url":"https://github.com/fastify/fastify-multipart/security/advisories/GHSA-5849-5m6q-9632","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":35,"priority":"moyenne","reasons":[]},{"id":"CVE-2025-13647","published":"2026-11-02T10:17:10.707","description":"The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.\n\nSuccessful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.","cvss":5.8,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-200"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":35,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-101185","published":"2026-11-02T07:18:03.483","description":"OOB read vulnerability in the peripheral module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.","cvss":5.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-805"],"references":[{"url":"https://consumer.huawei.com/cn/support/bulletinlaptops/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":35,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-101183","published":"2026-11-02T07:18:03.360","description":"UAF vulnerability in the location service module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":5.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-416"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":35,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-101182","published":"2026-11-02T07:18:03.220","description":"Race condition vulnerability in the location service module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":5.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-362"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":35,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-120316","published":"2026-11-02T03:17:29.760","description":"http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.","cvss":5.9,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","vendors":["http4k"],"products":["http4k"],"cwes":["CWE-22"],"references":[{"url":"https://github.com/http4k/http4k/security/advisories/GHSA-wq4x-r858-gmmj","tags":["Avis éditeur"]},{"url":"https://www.vulncheck.com/advisories/http4k-before-6.62.0.0-ee-path-traversal-via-thymeleaftemplates-template-resolution","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"http4k","product":"http4k","ranges":["< 6.62.0.0-ee"],"fixed":["6.62.0.0-ee"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":35,"priority":"moyenne","reasons":[]},{"id":"CVE-2026-91910","published":"2026-11-02T13:17:40.797","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure.","cvss":5.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-22"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":34,"priority":"basse","reasons":[]},{"id":"CVE-2026-91908","published":"2026-11-02T13:17:40.497","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.","cvss":5.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H","vendors":[],"products":[],"cwes":["CWE-347"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":34,"priority":"basse","reasons":[]},{"id":"CVE-2026-101174","published":"2026-11-02T07:18:02.273","description":"DoS vulnerability in the DSoftBus module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":5.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-400"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":34,"priority":"basse","reasons":[]},{"id":"CVE-2026-118333","published":"2026-10-27T23:03:14.507Z","description":"Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","cvss":5.4,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","vendors":["google"],"products":["chrome"],"cwes":["CWE-862"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/571147583","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00201,"epssPercentile":0.10044,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118333 Missing authorization in Video","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118333","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":34,"priority":"basse","reasons":[]},{"id":"CVE-2026-118337","published":"2026-10-27T23:03:13.074Z","description":"Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","cvss":5.4,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","vendors":["google"],"products":["chrome"],"cwes":["CWE-284"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/569286605","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00201,"epssPercentile":0.10044,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118337 Improper access control in Forms","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118337","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":34,"priority":"basse","reasons":[]},{"id":"CVE-2026-120458","published":"2026-11-02T15:17:29.697","description":"Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.","cvss":5.5,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-835"],"references":[{"url":"https://github.com/ultravideo/kvazaar/blob/v2.3.2/src/encmain.c#L339-L357","tags":[]},{"url":"https://github.com/ultravideo/kvazaar/commit/8a2f109be283e87008c679d635966cc034da39c6","tags":[]},{"url":"https://github.com/ultravideo/kvazaar/issues/452","tags":[]},{"url":"https://github.com/ultravideo/kvazaar/releases/tag/v2.3.2","tags":[]},{"url":"https://hackmd.io/@haindpwn/kvazaar-y4m-header-missing-newline-infinite-loop","tags":[]},{"url":"https://www.vulncheck.com/advisories/kvazaar-through-2.3.2-infinite-loop-dos-via-y4m-header-parser","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120458 - Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser","link":"https://cvefeed.io/vuln/detail/CVE-2026-120458","published":"2026-11-02T14:29:15.000Z"}],"exploits":[],"score":33,"priority":"basse","reasons":[]},{"id":"CVE-2026-120454","published":"2026-11-02T15:17:28.950","description":"The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service.","cvss":5.5,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-476"],"references":[{"url":"https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/decmpfs.c#L1154-L1169","tags":[]},{"url":"https://github.com/sleuthkit/sleuthkit/issues/3583","tags":[]},{"url":"https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0","tags":[]},{"url":"https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read","tags":[]},{"url":"https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-null-pointer-dereference-via-decmpfs-lzvn-decompression","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120454 - The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression","link":"https://cvefeed.io/vuln/detail/CVE-2026-120454","published":"2026-11-02T14:29:11.000Z"}],"exploits":[],"score":33,"priority":"basse","reasons":[]},{"id":"CVE-2026-91906","published":"2026-11-02T13:17:40.183","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.","cvss":5.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-732"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":33,"priority":"basse","reasons":[]},{"id":"CVE-2026-91904","published":"2026-11-02T13:17:39.870","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.","cvss":5.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-732"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":33,"priority":"basse","reasons":[]},{"id":"CVE-2026-101184","published":"2026-11-02T08:17:35.800","description":"Permission control vulnerability in the Bluetooth module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":5.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-264"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":33,"priority":"basse","reasons":[]},{"id":"CVE-2026-101181","published":"2026-11-02T07:18:03.097","description":"Permission control vulnerability in the WLAN module. \nImpact: Successful exploitation of this vulnerability may affect service confidentiality.","cvss":5.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-200"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":33,"priority":"basse","reasons":[]},{"id":"CVE-2026-120275","published":"2026-11-01T23:17:28.900","description":"A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown part of the component Find Command Handler. The manipulation of the argument -exec results in os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":5.5,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","vendors":["shanghai xi yu ji zhi technology"],"products":["minimax code"],"cwes":["CWE-77","CWE-78"],"references":[{"url":"https://vuldb.com/cve/CVE-2026-120275","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1007426","tags":["Avis tiers"]},{"url":"https://mcniyfj5bw9b.feishu.cn/docx/RenxdtY52oBlqRxN4S7csZtNnUc","tags":[]},{"url":"https://vuldb.com/vuln/429619","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429619/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"Shanghai Xi Yu Ji Zhi Technology","product":"Minimax Code","ranges":["0.5.8"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":33,"priority":"basse","reasons":[]},{"id":"CVE-2026-120233","published":"2026-11-01T16:18:14.290","description":"A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendors":["ag-ui-protocol"],"products":["ag-ui"],"cwes":["CWE-200","CWE-284"],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2575","tags":["Suivi de bug","Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2520","tags":["Exploit","Suivi de bug"]},{"url":"https://vuldb.com/cve/CVE-2026-120233","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015143","tags":["Avis tiers"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/","tags":["Produit"]},{"url":"https://vuldb.com/vuln/429592","tags":["Base de vulnérabilités"]},{"url":"https://vuldb.com/vuln/429592/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"ag-ui-protocol","product":"ag-ui","ranges":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.00414,"epssPercentile":0.35661,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":33,"priority":"basse","reasons":[]},{"id":"CVE-2026-120492","published":"2026-11-02T15:17:31.210","description":"Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant on origins that strip semicolon path parameters.","cvss":5.4,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-918"],"references":[{"url":"https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L199-L208","tags":[]},{"url":"https://github.com/Chainlit/chainlit/blob/2.12.0/backend/chainlit/mcp.py#L90-L177","tags":[]},{"url":"https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j","tags":[]},{"url":"https://www.vulncheck.com/advisories/chainlit-2.12.0-ssrf-via-semicolon-path-segment-in-mcp-allowed-urls","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120492 - Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls","link":"https://cvefeed.io/vuln/detail/CVE-2026-120492","published":"2026-11-02T14:29:20.000Z"}],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120491","published":"2026-11-02T15:17:31.040","description":"Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.","cvss":5.4,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://www.vulncheck.com/advisories/wing-ftp-server-before-8.2.6-stored-xss-via-nowpath-in-legacy-activity-page","tags":[]},{"url":"https://www.wftpserver.com/serverhistory.htm","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120491 - Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page","link":"https://cvefeed.io/vuln/detail/CVE-2026-120491","published":"2026-11-02T14:29:20.000Z"}],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120488","published":"2026-11-02T15:17:30.653","description":"LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.","cvss":5.4,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://github.com/laradashboard/laradashboard/blob/v1.4.8/resources/js/lara-builder/blocks/text-editor/render.php#L99-L104","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gg9-jh9p-fw37","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rf5h-55h2-jmf8","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-w878-x2w9-3r6f","tags":[]},{"url":"https://www.vulncheck.com/advisories/laradashboard-before-1.4.9-stored-xss-via-larabuilder-design-json-block-content","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120488 - LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content","link":"https://cvefeed.io/vuln/detail/CVE-2026-120488","published":"2026-11-02T14:29:18.000Z"}],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120457","published":"2026-11-02T15:17:29.507","description":"libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-196"],"references":[{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.7/src/decode.c#L556-L586","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/64","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/pull/66","tags":[]},{"url":"https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/tag/v1.1.7","tags":[]},{"url":"https://hackmd.io/@haindpwn/libaec-se-decode-fs-signedness-oob-read","tags":[]},{"url":"https://www.vulncheck.com/advisories/libaec-through-1.1.7-out-of-bounds-read-via-m-se-decode-second-extension-decoder","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120457 - libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder","link":"https://cvefeed.io/vuln/detail/CVE-2026-120457","published":"2026-11-02T14:29:13.000Z"}],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120452","published":"2026-11-02T15:17:28.553","description":"libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.","cvss":5.4,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://github.com/gphoto/libgphoto2/blob/v2.5.34/camlibs/jl2005c/jl2005bcd_decompress.c#L127-L130","tags":[]},{"url":"https://github.com/gphoto/libgphoto2/commit/30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb","tags":[]},{"url":"https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442","tags":[]},{"url":"https://github.com/gphoto/libgphoto2/issues/1326","tags":[]},{"url":"https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow","tags":[]},{"url":"https://www.vulncheck.com/advisories/libgphoto2-through-2.5.34-heap-out-of-bounds-read-write-via-jl2005c-thumbnail-conversion","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120452 - libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion","link":"https://cvefeed.io/vuln/detail/CVE-2026-120452","published":"2026-11-02T14:29:10.000Z"}],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120449","published":"2026-11-02T15:17:27.937","description":"Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-672"],"references":[{"url":"https://github.com/outline/outline/blob/v1.11.0/server/commands/shareLoader.ts#L50-L77","tags":[]},{"url":"https://github.com/outline/outline/commit/d015a32459b5f5c5a8ef67aeb81742eeab430c52","tags":[]},{"url":"https://github.com/outline/outline/releases/tag/v1.12.0","tags":[]},{"url":"https://github.com/outline/outline/security/advisories/GHSA-rq53-m97j-f2pg","tags":[]},{"url":"https://www.vulncheck.com/advisories/outline-before-1.12.0-improper-access-control-via-public-document-shares","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120449 - Outline before 1.12.0 Improper Access Control via Public Document Shares","link":"https://cvefeed.io/vuln/detail/CVE-2026-120449","published":"2026-11-02T14:29:08.000Z"}],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120441","published":"2026-11-02T15:17:26.307","description":"OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-89"],"references":[{"url":"https://github.com/owntone/owntone-server/blob/29.3/src/mpd.c#L3029","tags":[]},{"url":"https://github.com/owntone/owntone-server/commit/3164f12d18cd91c4973cc28f62298929cadac7da","tags":[]},{"url":"https://www.vulncheck.com/advisories/owntone-server-through-29.3-sql-injection-via-mpd-sticker-find-command","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120440","published":"2026-11-02T15:17:26.103","description":"QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendors":[],"products":[],"cwes":["CWE-401"],"references":[{"url":"https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0","tags":[]},{"url":"https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w","tags":[]},{"url":"https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120430","published":"2026-11-02T15:17:24.387","description":"Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.","cvss":5.4,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","vendors":[],"products":[],"cwes":["CWE-639"],"references":[{"url":"https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/controllers/camaleon_cms/admin/categories_controller.rb","tags":[]},{"url":"https://github.com/owen2345/camaleon-cms/commit/fa465e994bcbf4e7be4605853c204b73dea7bbc5","tags":[]},{"url":"https://github.com/owen2345/camaleon-cms/pull/1148","tags":[]},{"url":"https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2","tags":[]},{"url":"https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-idor-via-admin-categoriescontroller","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-105601","published":"2026-11-02T14:17:34.670","description":"Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5","cvss":5.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://www.php-web-design.com/Information/stageit-6-changelog.html","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2024-2372","published":"2026-11-02T11:17:28.460","description":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.","cvss":5.4,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-601"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-103310","published":"2026-11-02T08:17:35.927","description":"The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","vendors":[],"products":[],"cwes":[],"references":[{"url":"https://wpscan.com/vulnerability/f3b66147-5910-4901-b595-12a5b1db5f8b/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-68590","published":"2026-11-02T03:17:38.213","description":"In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-125"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-68588","published":"2026-11-02T03:17:37.950","description":"In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01334054 / MOLY01312486; Issue ID: MSV-7920.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-190"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20600","published":"2026-11-02T03:17:37.790","description":"In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01416152; Issue ID: MSV-7924.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-617"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20598","published":"2026-11-02T03:17:37.500","description":"In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01755742; Issue ID: MSV-8896.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-125"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20597","published":"2026-11-02T03:17:37.323","description":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758223; Issue ID: MSV-8909.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-125"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20596","published":"2026-11-02T03:17:37.187","description":"In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758225; Issue ID: MSV-8910.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-125"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20594","published":"2026-11-02T03:17:36.930","description":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01349680 / MOLY01369097; Issue ID: MSV-9364.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-125"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20593","published":"2026-11-02T03:17:36.790","description":"In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01707455; Issue ID: MSV-9503.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-617"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20578","published":"2026-11-02T03:17:35.527","description":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879164; Issue ID: MSV-9846.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-757"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20563","published":"2026-11-02T03:17:33.583","description":"In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01777997; Issue ID: MSV-8905.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20562","published":"2026-11-02T03:17:33.450","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775984; Issue ID: MSV-8907.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":[],"products":[],"cwes":["CWE-1284"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20561","published":"2026-11-02T03:17:33.317","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01750090; Issue ID: MSV-8908.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-125"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT2735","MT2737","MT6739","MT6761","MT6762","MT6763","MT6765","MT6767","MT6768","MT6769","MT6771","MT6779","MT6781"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20560","published":"2026-11-02T03:17:33.190","description":"In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870543; Issue ID: MSV-9070.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-125"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT6835","MT6878","MT6897","MT6899","MT8676","MT8755","MT8775","MT8792","MT8793","MT8863","MT8873","MT8883"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-20555","published":"2026-11-02T03:17:32.557","description":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876664; Issue ID: MSV-9834.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-125"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2716","MT6813","MT6815","MT6835","MT6858","MT6878","MT6881","MT6897","MT6899","MT6982","MT6986","MT6988","MT6991","MT6993"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-120278","published":"2026-11-02T00:18:11.003","description":"A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","cvss":5.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendors":["wavlink"],"products":["wn536ax6-a"],"cwes":["CWE-287","CWE-306"],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_vpn_list_info_disclosure.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120278","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/919506","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429622","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429622/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"WAVLINK","product":"WN536AX6-A","ranges":["V260507_2.0.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":32,"priority":"basse","reasons":[]},{"id":"CVE-2026-102801","published":"2026-11-02T14:17:32.783","description":"Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email=\"1\"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.","cvss":5.1,"cvssVersion":"4.0","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":[],"products":[],"cwes":["CWE-200"],"references":[{"url":"https://www.regularlabs.com/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":31,"priority":"basse","reasons":[]},{"id":"CVE-2026-74760","published":"2026-11-01T17:16:34.420","description":"Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state.\n\nThe gcloud-auth login and application-default login commands send a state parameter with the authorization request, then take the code from the first request to reach their loopback listener without comparing the returned state.\n\nA local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials, so the user's tools then act as the attacker's account.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":["google-auth"],"cwes":["CWE-346"],"references":[{"url":"https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/bin/gcloud-auth.pl","tags":["Analyse technique"]}],"affected":[{"source":"CNA","vendor":"","product":"Google-Auth","ranges":["0.11 → 0.12"],"fixed":[],"platforms":[],"ecosystem":"cpan.org/modules"}],"origin":"nvd","epss":0.00124,"epssPercentile":0.02097,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":31,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-74759","published":"2026-11-01T17:16:34.280","description":"Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials.\n\nAn external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply.\n\nAny caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":["google-auth"],"cwes":["CWE-918"],"references":[{"url":"https://metacpan.org/release/CJCOLLIER/Google-Auth-0.12/source/lib/Google/Auth/ExternalAccountCredentials/Aws.pm","tags":["Analyse technique"]}],"affected":[{"source":"CNA","vendor":"","product":"Google-Auth","ranges":["0.12"],"fixed":[],"platforms":[],"ecosystem":"cpan.org/modules"}],"origin":"nvd","epss":0.00177,"epssPercentile":0.07227,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":31,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2025-62819","published":"2026-11-02T15:17:11.403","description":"Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":[],"references":[{"url":"https://support.keyfactor.com/hc/en-us/articles/57971026069531-Security-advisory-EJBCA-unauthorized-client-certificate-renewal-in-RA-Web","tags":[]},{"url":"https://trust.keyfactor.com","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-114364","published":"2026-11-02T14:17:35.930","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.\n\n\n\nThis CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters.\nReference: https://cve.org/CVERecord?id=CVE-2026-77051\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-89"],"references":[{"url":"https://lists.apache.org/thread.html/j65oo441q5gpr4d0ljb644r9mdro2slm","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-113687","published":"2026-11-02T14:17:35.790","description":"Improper isolation or compartmentalization vulnerability in Apache Syncope.\n\n\n\nAn administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-653"],"references":[{"url":"https://lists.apache.org/thread.html/xxfmworgxt6bf1got05b5pqbb679zjp0","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-113511","published":"2026-11-02T14:17:35.650","description":"Authorization bypass through User-Controlled key vulnerability in Apache Syncope.\n\n\n\nA delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-639"],"references":[{"url":"https://lists.apache.org/thread.html/gn7y6k37xgody4wt4o981cywcovgw106","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-111959","published":"2026-11-02T14:17:35.493","description":"Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-20","CWE-125"],"references":[{"url":"https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-110535","published":"2026-11-02T14:17:35.270","description":"Improper Privilege Management vulnerability in Apache Syncope.\n\n\n\nAuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.\nThis issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-269"],"references":[{"url":"https://lists.apache.org/thread.html/25vbq0pvj8svk8gl8pjld1j0nzrdxy26","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-109083","published":"2026-11-02T14:17:35.127","description":"Improper isolation or compartmentalization vulnerability in Apache Syncope.\n\nAn administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-653"],"references":[{"url":"https://lists.apache.org/thread.html/zmzxzxv7wjzn071jgn069y2rqjpcrt3s","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20595","published":"2026-11-02T03:17:37.053","description":"In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-1286"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20592","published":"2026-11-02T03:17:36.657","description":"In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01744265; Issue ID: MSV-9505.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-532"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20591","published":"2026-11-02T03:17:36.537","description":"In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20590","published":"2026-11-02T03:17:36.410","description":"In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11410704; Issue ID: MSV-9574.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-121"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20585","published":"2026-11-02T03:17:36.283","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20584","published":"2026-11-02T03:17:36.163","description":"In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9746.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20583","published":"2026-11-02T03:17:36.037","description":"In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9747.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20582","published":"2026-11-02T03:17:35.913","description":"In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-415"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20581","published":"2026-11-02T03:17:35.787","description":"In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20580","published":"2026-11-02T03:17:35.660","description":"In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11412004; Issue ID: MSV-9752.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20577","published":"2026-11-02T03:17:35.397","description":"In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Issue ID: MSV-9866.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-280"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20576","published":"2026-11-02T03:17:35.270","description":"In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-191"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20575","published":"2026-11-02T03:17:35.150","description":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-9921.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-843"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20574","published":"2026-11-02T03:17:35.027","description":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431400; Issue ID: MSV-9922.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-843"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20573","published":"2026-11-02T03:17:34.893","description":"In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-415"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20572","published":"2026-11-02T03:17:34.767","description":"In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-191"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20571","published":"2026-11-02T03:17:34.640","description":"In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11434319; Issue ID: MSV-9925.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-843"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20570","published":"2026-11-02T03:17:34.520","description":"In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9926.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20569","published":"2026-11-02T03:17:34.390","description":"In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9927.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20568","published":"2026-11-02T03:17:34.247","description":"In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11439283; Issue ID: MSV-10003.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20567","published":"2026-11-02T03:17:34.087","description":"In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-10004.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20566","published":"2026-11-02T03:17:33.963","description":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: MOLY01923663 / ALPS11315955; Issue ID: MSV-10866.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20565","published":"2026-11-02T03:17:33.830","description":"In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778991; Issue ID: MSV-8900.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20564","published":"2026-11-02T03:17:33.710","description":"In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01780439; Issue ID: MSV-8901.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":[],"products":[],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20559","published":"2026-11-02T03:17:33.073","description":"In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365081; Issue ID: MSV-9545.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT6993","MT8910"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20558","published":"2026-11-02T03:17:32.947","description":"In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365070; Issue ID: MSV-9547.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-416"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT6993","MT8910"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20553","published":"2026-11-02T03:17:32.300","description":"In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11468968; Issue ID: MSV-10166.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2713","MT2718","MT2737","MT6781","MT6789","MT6813","MT6835","MT6855","MT6858","MT6878","MT6879","MT6880","MT6881","MT6886"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20552","published":"2026-11-02T03:17:32.170","description":"In ccci, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11523478 (Note: For MT6880, MT6890) / ALPS11297423 (Note: For MT6813, MT6986, MT6982, MT6980D) / AUTO00864897 (Note: For MT2735, MT2737); Issue ID: MSV-10724.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2735","MT2737","MT6813","MT6880","MT6890","MT6980D","MT6982","MT6986","MT6988","MT6990"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20551","published":"2026-11-02T03:17:32.040","description":"In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309305; Issue ID: MSV-10730.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2737","MT6813","MT6980D","MT6982","MT6986","MT6988","MT6990"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2026-20550","published":"2026-11-02T03:17:31.907","description":"In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309816; Issue ID: MSV-10731.","cvss":null,"cvssVersion":null,"cvssSource":null,"severity":null,"vector":null,"vendors":["mediatek, inc."],"products":["mediatek chipset"],"cwes":["CWE-787"],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[]}],"affected":[{"source":"CNA","vendor":"MediaTek, Inc.","product":"MediaTek chipset","ranges":["MT2735","MT2737","MT6880","MT6890","MT6980D","MT6982","MT6986","MT6988","MT6990"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":30,"priority":"basse","reasons":["Score CVSS pas encore publié"]},{"id":"CVE-2024-9517","published":"2026-11-02T12:16:57.873","description":"The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.\n\nThis vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.","cvss":4.9,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-613"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":29,"priority":"basse","reasons":[]},{"id":"CVE-2025-12544","published":"2026-11-02T11:17:30.477","description":"The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application.\n\nThe security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.","cvss":4.8,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":29,"priority":"basse","reasons":[]},{"id":"CVE-2024-5617","published":"2026-11-02T06:17:41.933","description":"The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.\n\nThis functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.","cvss":4.8,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-799"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3414/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":29,"priority":"basse","reasons":[]},{"id":"CVE-2026-120274","published":"2026-11-01T21:17:08.157","description":"A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.","cvss":4.7,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","vendors":["beecue"],"products":["fastbee"],"cwes":["CWE-74","CWE-94"],"references":[{"url":"https://gitee.com/beecue/fastbee/commit/890a33846005a937a58cccd738b7fb9821b82ea9","tags":["Correctif"]},{"url":"https://vuldb.com/cve/CVE-2026-120274","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1003643","tags":["Avis tiers"]},{"url":"https://gitee.com/beecue/fastbee/","tags":["Produit"]},{"url":"https://gitee.com/x0n1on/fastbee/issues/IKIU7D","tags":["Suivi de bug"]},{"url":"https://vuldb.com/vuln/429618","tags":["Base de vulnérabilités"]},{"url":"https://vuldb.com/vuln/429618/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"beecue","product":"FastBee","ranges":["2.0","2.1.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.00248,"epssPercentile":0.16164,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":29,"priority":"basse","reasons":[]},{"id":"CVE-2026-91909","published":"2026-11-02T13:17:40.650","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.","cvss":4.6,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-88"],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":28,"priority":"basse","reasons":[]},{"id":"CVE-2024-7075","published":"2026-11-02T10:17:10.470","description":"The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.\n\nSuccessful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented.","cvss":4.6,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-79"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3569/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":28,"priority":"basse","reasons":[]},{"id":"CVE-2026-101179","published":"2026-11-02T07:18:02.830","description":"Buffer overflow vulnerability in the file preview module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":4.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-19"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":28,"priority":"basse","reasons":[]},{"id":"CVE-2026-120320","published":"2026-11-02T02:18:47.327","description":"A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.","cvss":4.7,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","vendors":["jxxghp"],"products":["moviepilot"],"cwes":["CWE-20","CWE-502"],"references":[{"url":"https://github.com/jxxghp/MoviePilot/commit/6034dcc880c13079aeb398dbe32c346ebcd3a6d2","tags":["Correctif"]},{"url":"https://github.com/jxxghp/MoviePilot/pull/6930","tags":["Suivi de bug","Correctif"]},{"url":"https://github.com/jxxghp/MoviePilot/releases/tag/v3.1.3","tags":["Correctif"]},{"url":"https://github.com/0xGenesi/CVE/blob/main/MoviePilot_Workflow_Fork_Pickle_Deserialization_RCE.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120320","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015025","tags":["Avis tiers"]},{"url":"https://github.com/jxxghp/MoviePilot/","tags":["Produit"]},{"url":"https://vuldb.com/vuln/429653","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429653/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"jxxghp","product":"MoviePilot","ranges":["3.1.0","3.1.1","3.1.2"],"fixed":["3.1.3"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":28,"priority":"basse","reasons":[]},{"id":"CVE-2026-120237","published":"2026-11-01T18:17:13.497","description":"A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","vendors":["ag-ui-protocol"],"products":["ag-ui"],"cwes":["CWE-400","CWE-404"],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/3241","tags":["Suivi de bug","Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2525","tags":["Exploit","Suivi de bug"]},{"url":"https://vuldb.com/cve/CVE-2026-120237","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015179","tags":["Avis tiers"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/","tags":["Produit"]},{"url":"https://vuldb.com/vuln/429596","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429596/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"ag-ui-protocol","product":"ag-ui","ranges":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.00407,"epssPercentile":0.34937,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":27,"priority":"basse","reasons":[]},{"id":"CVE-2026-120235","published":"2026-11-01T16:18:14.757","description":"A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","vendors":["ag-ui-protocol"],"products":["ag-ui"],"cwes":["CWE-400","CWE-404"],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/commit/9e7b2b00bce215bbf731f1e6094f63812527c432","tags":["Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2627","tags":["Suivi de bug","Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-10-30","tags":["Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2522","tags":["Exploit","Suivi de bug"]},{"url":"https://vuldb.com/cve/CVE-2026-120235","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015147","tags":["Avis tiers"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/","tags":["Produit"]},{"url":"https://vuldb.com/vuln/429594","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429594/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"ag-ui-protocol","product":"ag-ui","ranges":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.00354,"epssPercentile":0.29059,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":27,"priority":"basse","reasons":[]},{"id":"CVE-2026-120234","published":"2026-11-01T16:18:14.530","description":"A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","vendors":["ag-ui-protocol"],"products":["ag-ui"],"cwes":["CWE-400","CWE-404"],"references":[{"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2698","tags":["Suivi de bug","Correctif"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2521","tags":["Exploit","Suivi de bug"]},{"url":"https://vuldb.com/cve/CVE-2026-120234","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1015146","tags":["Avis tiers"]},{"url":"https://github.com/ag-ui-protocol/ag-ui/","tags":["Produit"]},{"url":"https://vuldb.com/vuln/429593","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429593/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"ag-ui-protocol","product":"ag-ui","ranges":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.00303,"epssPercentile":0.23047,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":27,"priority":"basse","reasons":[]},{"id":"CVE-2026-118319","published":"2026-10-27T23:03:20.699Z","description":"Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":4.3,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/576194994","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00173,"epssPercentile":0.06764,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118319 Memory corruption in Skia","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118319","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":27,"priority":"basse","reasons":[]},{"id":"CVE-2026-118322","published":"2026-10-27T23:03:11.846Z","description":"Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)","cvss":4.3,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","vendors":["google"],"products":["chrome"],"cwes":["CWE-119"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/568895029","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00205,"epssPercentile":0.10532,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118322 Memory corruption in ANGLE","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118322","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":27,"priority":"basse","reasons":[]},{"id":"CVE-2026-118318","published":"2026-10-27T23:03:10.313Z","description":"Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)","cvss":4.3,"cvssVersion":"3.1","cvssSource":"CISA-ADP","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","vendors":["google"],"products":["chrome"],"cwes":["CWE-284"],"references":[{"url":"https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","tags":[]},{"url":"https://issues.chromium.org/issues/565133743","tags":[]}],"affected":[{"source":"CNA","vendor":"Google","product":"Chrome","ranges":["156.0.8078.73 → < 156.0.8078.73"],"fixed":["156.0.8078.73"],"platforms":[]}],"origin":"rss","epss":0.00198,"epssPercentile":0.09582,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[{"source":"Microsoft","kind":"editeur","title":"Chromium: CVE-2026-118318 Improper access control in V8","link":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118318","published":"2026-10-31T14:00:00.000Z"}],"exploits":[],"score":27,"priority":"basse","reasons":[]},{"id":"CVE-2026-120489","published":"2026-11-02T15:17:30.860","description":"Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-863"],"references":[{"url":"https://github.com/outline/outline/blob/v1.11.0/server/commands/documentCreator.ts#L135-L143","tags":[]},{"url":"https://github.com/outline/outline/commit/d249b34e8e5fd465d542cad87190d411fdcbd5dc","tags":[]},{"url":"https://github.com/outline/outline/releases/tag/v1.12.0","tags":[]},{"url":"https://github.com/outline/outline/security/advisories/GHSA-h6ff-rw9x-5mq2","tags":[]},{"url":"https://www.vulncheck.com/advisories/outline-before-1.12.0-incorrect-authorization-via-authorizedocumentpublish-detached-draft","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120489 - Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft","link":"https://cvefeed.io/vuln/detail/CVE-2026-120489","published":"2026-11-02T14:29:19.000Z"}],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-120450","published":"2026-11-02T15:17:28.140","description":"LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-863"],"references":[{"url":"https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9","tags":[]},{"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv","tags":[]},{"url":"https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120450 - LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool","link":"https://cvefeed.io/vuln/detail/CVE-2026-120450","published":"2026-11-02T14:29:08.000Z"}],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-120427","published":"2026-11-02T15:17:23.770","description":"MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-639"],"references":[{"url":"https://github.com/zmister2016/MrDoc/blob/v1.1.1/app_doc/views.py#L1983-L1996","tags":[]},{"url":"https://github.com/zmister2016/MrDoc/commit/ec93679499fb6ea88ce868ffc9169fe025917095","tags":[]},{"url":"https://github.com/zmister2016/MrDoc/releases/tag/v1.1.1","tags":[]},{"url":"https://hackmd.io/@hieund/mrdoc-get-doctemp-missing-owner-check-cross-user-template-read","tags":[]},{"url":"https://www.vulncheck.com/advisories/mrdoc-through-1.1.1-missing-authorization-via-get-doctemp-template-read","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2024-12141","published":"2026-11-02T13:17:29.440","description":"The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.\n\nAn attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-601"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-18800","published":"2026-11-02T10:17:11.293","description":"When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.\n\nA malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.","cvss":4.4,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-532"],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-101180","published":"2026-11-02T07:18:02.970","description":"DoS vulnerability in the file parsing module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","vendors":[],"products":[],"cwes":["CWE-674"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-101175","published":"2026-11-02T07:18:02.420","description":"Null pointer dereference vulnerability in the ArkWeb module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","vendors":[],"products":[],"cwes":["CWE-248"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-120343","published":"2026-11-02T05:18:24.860","description":"A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-79","CWE-94"],"references":[{"url":"https://github.com/capivara-research/manageassessment2-stored-xss/blob/main/manageassessment2-stored-xss.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120343","tags":[]},{"url":"https://vuldb.com/submit/1017562","tags":[]},{"url":"https://vuldb.com/vuln/429668","tags":[]},{"url":"https://vuldb.com/vuln/429668/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-120339","published":"2026-11-02T04:16:53.440","description":"A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-79","CWE-94"],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/updatedetailsfromfaculty-stored-xss.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120339","tags":[]},{"url":"https://vuldb.com/submit/1016326","tags":[]},{"url":"https://vuldb.com/vuln/429664","tags":[]},{"url":"https://vuldb.com/vuln/429664/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-120334","published":"2026-11-02T03:17:30.630","description":"A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","cvss":4.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","vendors":["deepset-ai"],"products":["farm"],"cwes":["CWE-22"],"references":[{"url":"https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_FARM_Tokenizer_Load_via_Attacker-Controlled_vocab_filename.md","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120334","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1016276","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429659","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429659/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"deepset-ai","product":"farm","ranges":["0.1","0.2","0.3","0.4","0.5","0.6","0.7","0.8.0"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":26,"priority":"basse","reasons":[]},{"id":"CVE-2026-117549","published":"2026-11-02T11:17:30.997","description":"@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still passes the original cookie value to the session decoder, so a session whose signature did not validate is decrypted anyway. The practical effect appears when an application supplies the cookie signing secret independently of the session encryption key and rotates only the signing secret to retire existing sessions while keeping the encryption key active, because a holder of an old session cookie can strip the now obsolete signature and keep using the session. The attacker must already possess an unexpired encrypted session cookie and needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key. The issue is fixed in @fastify/secure-session 8.4.2, which no longer decodes the session when the signed cookie option is set and the signature check fails, and users should upgrade to 8.4.2 or later. As a workaround, rotate the session encryption key rather than relying on rotation of the cookie signing secret alone.","cvss":4.2,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","vendors":[],"products":[],"cwes":["CWE-347"],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","tags":[]},{"url":"https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-4cgq-x5f7-r8jv","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":25,"priority":"basse","reasons":[]},{"id":"CVE-2026-101170","published":"2026-11-02T07:18:01.477","description":"DoS vulnerability in the file parsing module.\nImpact: Successful exploitation of this vulnerability may affect availability.","cvss":4,"cvssVersion":"3.1","cvssSource":"CNA","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendors":[],"products":[],"cwes":["CWE-115"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":24,"priority":"basse","reasons":[]},{"id":"CVE-2026-120215","published":"2026-11-02T11:17:31.413","description":"@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.","cvss":3.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","vendors":[],"products":[],"cwes":["CWE-248"],"references":[{"url":"https://cna.openjsf.org/security-advisories.html","tags":[]},{"url":"https://github.com/fastify/fastify-cors/security/advisories/GHSA-8c3j-mm64-257c","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":22,"priority":"basse","reasons":[]},{"id":"CVE-2026-101177","published":"2026-11-02T07:18:02.700","description":"Permission control vulnerability in the Optimizer module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.","cvss":3.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","vendors":[],"products":[],"cwes":["CWE-264"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":22,"priority":"basse","reasons":[]},{"id":"CVE-2026-101171","published":"2026-11-02T07:18:01.777","description":"Permission control vulnerability in the background task management module.\nImpact: Successful exploitation of this vulnerability may affect service integrity.","cvss":3.6,"cvssVersion":"3.1","cvssSource":"CNA","severity":"LOW","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-264"],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","tags":[]},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/10/","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":22,"priority":"basse","reasons":[]},{"id":"CVE-2026-120340","published":"2026-11-02T05:18:22.723","description":"A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Global Session Handler. Executing a manipulation can lead to session expiration. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":3.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","vendors":[],"products":[],"cwes":["CWE-613"],"references":[{"url":"https://github.com/vinniboy021-blip/Advisory/blob/main/session-cookie-logout.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120340","tags":[]},{"url":"https://vuldb.com/submit/1016327","tags":[]},{"url":"https://vuldb.com/vuln/429665","tags":[]},{"url":"https://vuldb.com/vuln/429665/cti","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":22,"priority":"basse","reasons":[]},{"id":"CVE-2026-120309","published":"2026-11-02T03:17:28.217","description":"Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.","cvss":3.7,"cvssVersion":"3.1","cvssSource":"CNA","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","vendors":["nuxt"],"products":["nuxt"],"cwes":["CWE-436"],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-w7gw-66vg-99gq","tags":["Avis éditeur"]},{"url":"https://www.vulncheck.com/advisories/nuxt-4.6.0-before-4.6.2-route-param-confusion-via-getrouterparam","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"nuxt","product":"nuxt","ranges":["4.6.0 → < 4.6.2"],"fixed":["4.6.2"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial"},"mentions":[],"exploits":[],"score":22,"priority":"basse","reasons":[]},{"id":"CVE-2026-120453","published":"2026-11-02T15:17:28.750","description":"The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.","cvss":3.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"LOW","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","vendors":[],"products":[],"cwes":["CWE-125"],"references":[{"url":"https://github.com/sleuthkit/sleuthkit/blob/sleuthkit-4.15.0/tsk/fs/hfs.c#L4249-L4318","tags":[]},{"url":"https://github.com/sleuthkit/sleuthkit/issues/3583","tags":[]},{"url":"https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-4.15.0","tags":[]},{"url":"https://hackmd.io/@haindpwn/sleuthkit-hfs-decmpfs-attr-oob-read","tags":[]},{"url":"https://www.vulncheck.com/advisories/the-sleuth-kit-through-4.15.0-heap-out-of-bounds-read-via-hfs-decmpfs-header","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[{"source":"cvefeed.io","kind":"cve","title":"CVE-2026-120453 - The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header","link":"https://cvefeed.io/vuln/detail/CVE-2026-120453","published":"2026-11-02T14:29:10.000Z"}],"exploits":[],"score":20,"priority":"basse","reasons":[]},{"id":"CVE-2025-71450","published":"2026-11-02T15:17:12.650","description":"inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.","cvss":3.3,"cvssVersion":"3.1","cvssSource":"NVD","severity":"LOW","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","vendors":[],"products":[],"cwes":["CWE-127"],"references":[{"url":"https://github.com/benhoyt/inih/blob/r62/ini.c#L162-L169","tags":[]},{"url":"https://github.com/benhoyt/inih/commit/8e06f6b77b5d4471bdc6d85ada81b67d37354a5c","tags":[]},{"url":"https://github.com/benhoyt/inih/issues/223","tags":[]},{"url":"https://github.com/benhoyt/inih/pull/206","tags":[]},{"url":"https://github.com/benhoyt/inih/releases/tag/r63","tags":[]},{"url":"https://hackmd.io/@haindpwn/inih-long-line-discard-oob-read","tags":[]},{"url":"https://www.vulncheck.com/advisories/inih-before-r63-stack-buffer-under-read-in-ini-parse-stream-discard-loop","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":20,"priority":"basse","reasons":[]},{"id":"CVE-2026-120310","published":"2026-11-02T03:17:28.417","description":"Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.","cvss":3.1,"cvssVersion":"3.1","cvssSource":"NVD","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","vendors":["parse-community"],"products":["parse-server"],"cwes":["CWE-200"],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-2rcp-jc67-vq74","tags":["Avis éditeur"]},{"url":"https://www.vulncheck.com/advisories/parse-server-before-8.6.109-and-9.0.0-before-9.10.6-alpha.1-information-disclosure-via-object-update-response","tags":["Avis tiers"]}],"affected":[{"source":"CNA","vendor":"parse-community","product":"parse-server","ranges":["9.0.0 → < 9.10.6-alpha.1"],"fixed":["9.10.6-alpha.1"],"platforms":[]}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":19,"priority":"basse","reasons":[]},{"id":"CVE-2026-120242","published":"2026-11-01T19:16:59.583","description":"A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":2.4,"cvssVersion":"3.1","cvssSource":"NVD","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N","vendors":["ruijie"],"products":["rg-es205gc","rg-es206gc-p","rg-es208gc","rg-es210gc-lp","rg-es210gs-p"],"cwes":["CWE-79","CWE-94"],"references":[{"url":"https://github.com/byseeker/Ruijie-RG-ES-Series-Switches_XSS","tags":["Exploit"]},{"url":"https://vuldb.com/cve/CVE-2026-120242","tags":["Avis tiers"]},{"url":"https://vuldb.com/submit/1016042","tags":["Avis tiers"]},{"url":"https://vuldb.com/vuln/429601","tags":["Base de vulnérabilités","Analyse technique"]},{"url":"https://vuldb.com/vuln/429601/cti","tags":["Signature","Accès restreint"]}],"affected":[{"source":"CNA","vendor":"Ruijie","product":"RG-ES205GC","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]},{"source":"CNA","vendor":"Ruijie","product":"RG-ES206GC-P","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]},{"source":"CNA","vendor":"Ruijie","product":"RG-ES208GC","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]},{"source":"CNA","vendor":"Ruijie","product":"RG-ES210GC-LP","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]},{"source":"CNA","vendor":"Ruijie","product":"RG-ES210GS-P","ranges":["ESW_1.0(1)B1P48"],"fixed":[],"platforms":[]}],"origin":"nvd","epss":0.00202,"epssPercentile":0.10124,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":16,"priority":"basse","reasons":[]},{"id":"CVE-2026-107457","published":"2026-11-02T09:17:36.430","description":"A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.","cvss":2.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","vendors":[],"products":[],"cwes":["CWE-129","CWE-787"],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtmqtt/+/762286","tags":[]},{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107457:","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":14,"priority":"basse","reasons":[]},{"id":"CVE-2026-87718","published":"2026-11-01T23:17:30.727","description":"Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly. Users are recommended to upgrade to version 10.12.0 or 9.25.0, which fix the issue.","cvss":2.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-693"],"references":[{"url":"https://lists.apache.org/thread.html/fjq8v35zpkbtjwpzwkkpzocwtdgokp1m","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["9.24.0","10.10.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":14,"priority":"basse","reasons":[]},{"id":"CVE-2026-82559","published":"2026-11-01T22:17:47.370","description":"Insufficient session expiration in Apache Wicket.\n\norg.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest() wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every frame that arrives on it. Copying the request is deliberate and is documented as such, because the container recycles the upgrade request once the handshake is over. The container session is copied along with it, into an org.apache.wicket.protocol.ws.api.HttpSessionCopy holding the session attributes as they stood when the connection was opened. That second copy is not necessary, because a session, unlike a request, is not discarded at the end of a request. Every frame afterwards resolves its Wicket session through ISessionStore#lookup(), which reads it out of the copy, so the connection is detached from the live container session for as long as it stays open.\n\nEnding the session through the container therefore does not end the connection. After an idle timeout, an HttpSession#invalidate() call made from a filter or from a security framework, a container-managed logout, or a session replacement, the connection goes on resolving the org.apache.wicket.Session instance that existed when it was opened, together with that session's attributes and, for applications built on wicket-auth-roles, the signed-in state held on that same instance, so an authorization decision taken inside a WebSocket callback is taken against an identity that has already been revoked. The copy is also what the connection writes through: a Session#invalidateNow() issued from inside a WebSocket callback invalidates the copy and leaves the container session valid, and session attributes set over the connection are written to the copy rather than to the session.\n\nAn application is affected where it uses Wicket's native WebSocket support on pages or shared resources that require an authenticated session, and where sessions are ended by the container rather than by Wicket. Session#invalidateNow(), and AuthenticatedWebSession#invalidate() and #signOut() which call it, remain effective for a WebSocketBehavior on a page: they clear the page manager, and the connection can then no longer resolve the page it was opened for. A WebSocketResource is not limited in that way, because a frame naming a resource is served against a throwaway page and never consults the page manager, so such a connection outlives Wicket's own sign-out as well. Some containers close WebSocket connections themselves when the HTTP session they were opened under is destroyed, in which case the connection ends regardless; that is a property of the container rather than of Wicket. Applications that do not use the native WebSocket support are not affected.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":2.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-613"],"references":[{"url":"https://lists.apache.org/thread.html/5vkw9wz6gf135ccosj928zjs4hqy7bcv","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":14,"priority":"basse","reasons":[]},{"id":"CVE-2026-82558","published":"2026-11-01T22:17:47.187","description":"Missing authorization in Apache Wicket.\n\norg.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the client may invoke the component the behavior is attached to. Wicket opens a single WebSocket connection per page, and a message received on it is delivered to every WebSocketBehavior of that page. For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action. A WebSocketBehavior attached to such a component, or to a child of one, therefore receives the client's text and binary messages, together with a WebSocketRequestHandler that writes back to that client, where an Ajax behavior on the same component would be refused.\n\nAn application is affected where it attaches a WebSocketBehavior that overrides onMessage() to a component that it hides, disables, or restricts through its IAuthorizationStrategy, for example with MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation. The client needs a session of their own and a page of their own that contains such a component: messages are delivered only to pages in the page store of the client's own session, so this gives no access to another user's session, page or connection. Messages pushed by the server are not affected.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","cvss":2.3,"cvssVersion":"4.0","cvssSource":"CNA","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-862"],"references":[{"url":"https://lists.apache.org/thread.html/o1ojfn53742ztd13m93336t3kdjw2tq9","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["8.0.0 → 8.19.0","9.0.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":14,"priority":"basse","reasons":[]},{"id":"CVE-2026-82898","published":"2026-11-01T22:17:48.217","description":"Incorrect order of security checks in Apache Wicket.\n\norg.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are passed that page. Obtaining the page instantiates it, and instantiating a page runs the configured org.apache.wicket.authorization.IAuthorizationStrategy. An application that refuses an unauthenticated visitor by throwing org.apache.wicket.RestartResponseAtInterceptPageException therefore throws it from inside the isolation listener, before any policy has run. That exception replaces the request handler, so the policies are never consulted and a request that came from another origin is not refused.\n\nThe exception's constructor stores the URL of the request it interrupted, so that Component#continueToOriginalDestination() can resume it once the visitor has signed in. The stored URL is the one the policies would have refused. On sign in Wicket redirects to it, and that redirect is same-origin, so the policies allow it and the listener runs in the newly authenticated session. The whole URL is stored, its query string included, so an ordinary org.apache.wicket.markup.html.form.Form is resumed with the field values the original request carried in its query string and Form#onSubmit() runs with values another origin chose. A form POST is not needed for this; a plain top-level navigation carries them.\n\nAn application is affected where it registers ResourceIsolationRequestCycleListener, which is opt-in and is not registered by default, and where it refuses unauthorized access with RestartResponseAtInterceptPageException followed by continueToOriginalDestination(). No application override is involved on that path: IAuthorizationStrategy#isInstantiationAuthorized() documents throwing that exception, org.apache.wicket.authroles.authentication.AuthenticatedWebApplication throws it and org.apache.wicket.authroles.authentication.panel.UsernamePasswordPanel continues to the original destination, and org.apache.wicket.authorization.strategies.page.SimplePageAuthorizationStrategy in wicket-core installs the same pattern. A visitor who is already signed in is not affected, because no interception occurs. Request-body parameters stored alongside the intercepted URL are not applied to the resumed form: the resumption is a redirect, so the resumed request is a GET, and form components read their values from the query string on a GET.\n\nAs a workaround, refuse unauthorized access with org.apache.wicket.RestartResponseException instead, which does not store the original destination; visitors are then not returned to the page they asked for after signing in.\n\nThis issue affects Apache Wicket: from 9.1.0 through 9.24.0, from 10.0.0 through 10.11.0.\n\nReleases before 9.1.0, which is every 8.x release and 9.0.0, are not affected, because the resource isolation this issue concerns was introduced in 9.1.0. They are not protected either. Their only cross-origin defence is org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener, which works out where a request came from by reading its Origin header and falling back to its Referer header. Neither header need arrive: a browser does not send Origin on the plain GET a link uses, and the document on the other origin decides through its own referrer policy whether a Referer reaches the application at all. That mechanism therefore never made the guarantee the Fetch Metadata based policy makes, and on those releases a listener invocation from another origin is not reliably refused in the first place. Anyone on a release before 9.1.0 who wants this protection should upgrade to 9.x or 10.x and register ResourceIsolationRequestCycleListener.\n\nUsers are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.","cvss":2.1,"cvssVersion":"4.0","cvssSource":"CNA","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","vendors":["apache software foundation"],"products":["apache wicket"],"cwes":["CWE-696"],"references":[{"url":"https://lists.apache.org/thread.html/bm4mlwsgftxfg345zvdqj0skg1mktpyp","tags":["Avis éditeur"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache Wicket","ranges":["9.1.0 → 9.24.0","10.0.0 → 10.11.0"],"fixed":[],"platforms":[],"ecosystem":"repo.maven.apache.org/maven2"}],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":13,"priority":"basse","reasons":[]},{"id":"CVE-2026-100140","published":"2026-11-02T12:16:58.910","description":"An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.","cvss":1.9,"cvssVersion":"4.0","cvssSource":"CNA","severity":"LOW","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:Green","vendors":[],"products":[],"cwes":["CWE-190"],"references":[{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/764751","tags":[]},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/768900","tags":[]},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/768901","tags":[]},{"url":"https://codereview.qt-project.org/c/qt/qt5compat/+/768902","tags":[]},{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-100140:","tags":[]}],"affected":[],"origin":"nvd","epss":null,"epssPercentile":null,"kev":null,"ssvc":null,"mentions":[],"exploits":[],"score":11,"priority":"basse","reasons":[]}],"errors":[],"aiEnabled":true,"sources":[{"name":"NVD","ok":true,"detail":"247 CVE"},{"name":"CISA KEV","ok":true},{"name":"CVE.org","ok":true,"detail":"120 fiches"},{"name":"FIRST EPSS","ok":true},{"name":"Flux RSS","ok":false,"detail":"10/12 flux"}]}