Sync CVE metadata 2026-09-16

2026-10-27 16:51:03 +00:00 · 2026-09-16 08:31:24 +00:00
1 parent ce08950ab7
commit 782edbe6b6
@@ -1,8 +1,8 @@
 <div align="center">

-<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=172045-82865-1197" alt="PoC Index" width="100%"></a>
+<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=172078-82898-1197" alt="PoC Index" width="100%"></a>

-[![last sync](https://img.shields.io/badge/last%20sync-16%20Sep%202026%2008%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609160807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C865-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C197-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609160807)](https://github.com/0xMarcio/pocindex/stargazers)
+[![last sync](https://img.shields.io/badge/last%20sync-16%20Sep%202026%2008%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609160807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C898-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C197-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609160807)](https://github.com/0xMarcio/pocindex/stargazers)

 <a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>

@@ -0,0 +1,20 @@
+### [CVE-2026-48987](https://www.cve.org/CVERecord?id=CVE-2026-48987)
+**pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager**
+![](https://img.shields.io/static/v1?label=Vendor&message=pyload&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=pyload&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.5.0b3.dev101&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-401%3A%20Missing%20Release%20of%20Memory%20after%20Effective%20Lifetime&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents API endpoint, but get_events does not invoke the available clean method to remove inactive clients. An authenticated user can repeatedly submit unique UUID values, causing retained client objects and process memory to grow without bound even after requests stop. The resulting memory exhaustion can trigger an operating-system out-of-memory termination of pyLoad or host-wide instability and denial of service. This issue is fixed in version 0.5.0b3.dev101.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-c2f9-4mc8-j656
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,19 @@
+### [CVE-2026-49446](https://www.cve.org/CVERecord?id=CVE-2026-49446)
+**Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server**
+![](https://img.shields.io/static/v1?label=Vendor&message=azukaar&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Cosmos-Server&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.19&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-290%3A%20Authentication%20Bypass%20by%20Spoofing&color=brightgreen)
+
+### Description
+
+Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-2rx5-2g7j-2659
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,19 @@
+### [CVE-2026-53710](https://www.cve.org/CVERecord?id=CVE-2026-53710)
+**MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server**
+![](https://img.shields.io/static/v1?label=Vendor&message=IBM&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-context-forge&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.0.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20%28%27Code%20Injection%27%29&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-693%3A%20Protection%20Mechanism%20Failure&color=brightgreen)
+
+### Description
+
+MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-xm98-3vcf-fph7
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,22 @@
+### [CVE-2026-53957](https://www.cve.org/CVERecord?id=CVE-2026-53957)
+**Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint**
+![](https://img.shields.io/static/v1?label=Vendor&message=contentful&color=blue)
+![](https://img.shields.io/static/v1?label=Vendor&message=%40contentful&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=contentful-mcp-server&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-server&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-tools&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.7.19&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.4.5&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine those options with the server's CONTENTFUL_MANAGEMENT_TOKEN. After space_to_space_migration_handler enables the migration tools, a direct MCP call or prompt injection through attacker-controlled Contentful content can redirect Contentful Management API requests and their Authorization header to an attacker-controlled host or proxy. The regular tools that use createToolClient are unaffected because those tools pin the host from server configuration. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. This issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-2xhg-73j7-rrgx
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-54450](https://www.cve.org/CVERecord?id=CVE-2026-54450)
+**ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway**
+![](https://img.shields.io/static/v1?label=Vendor&message=stacklok&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=toolhive&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.29.1&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-pph6-vfjv-vpjw
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-54547](https://www.cve.org/CVERecord?id=CVE-2026-54547)
+**Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token**
+![](https://img.shields.io/static/v1?label=Vendor&message=pipeboard-co&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=meta-ads-mcp&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.0.115&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%3A%20Improper%20Authentication&color=brightgreen)
+
+### Description
+
+Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_token and pipeboard_token are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A network caller using the streamable-http transport can therefore send any X-Pipeboard-Token value, pass the guard without establishing authentication context, and cause get_auth_token() to fall back to the server operator's META_ACCESS_TOKEN. Subsequent MCP tools execute with the operator's Meta credentials and can read or modify the operator's Meta Ads data. Deployments using the default stdio transport or without META_ACCESS_TOKEN are not affected. This issue is fixed in version 1.0.115.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-2v2f-mvfg-ph56
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-54549](https://www.cve.org/CVERecord?id=CVE-2026-54549)
+**Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch**
+![](https://img.shields.io/static/v1?label=Vendor&message=pipeboard-co&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=meta-ads-mcp&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.0.115&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in meta_ads_mcp/core/utils.py, where httpx.AsyncClient uses follow_redirects=True and performs HTTP requests without validating the scheme, host, or resolved IP address. In a streamable-http deployment, a network caller can use any non-empty authorization value because Meta credential validation occurs after the image download, then direct the server to loopback services, private-network addresses, cloud metadata endpoints, or redirect-chained internal targets. The resulting server-side request forgery can expose internal data, invoke state-changing internal services, or disrupt reachable services. This issue is fixed in version 1.0.115.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-45gf-fjxp-cjpq
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-54637](https://www.cve.org/CVERecord?id=CVE-2026-54637)
+**Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile**
+![](https://img.shields.io/static/v1?label=Vendor&message=dragonflyoss&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=dragonfly&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.4.4-rc.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies those values into resource.Host, and handlePeerSuccess invokes Peer.DownloadTinyFile() for a TINY task. DownloadTinyFile() in scheduler/resource/standard/peer.go builds an HTTP GET request from the supplied address without destination validation, allowing a remote attacker to probe loopback, link-local, and private services and place up to TinyFileSize, 128 bytes, of a response in Task.DirectPiece for later retrieval. PeerHost.DownPort is restricted to ports 1024 through 65534, and the issue provides read SSRF rather than remote code execution. The remediation blocks loopback and link-local targets, while RFC1918 destinations remain reachable because IsGlobalUnicast accepts private ranges. This issue is fixed in 2.4.4-rc.3.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-chwm-m7g7-685g
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-54688](https://www.cve.org/CVERecord?id=CVE-2026-54688)
+**mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)**
+![](https://img.shields.io/static/v1?label=Vendor&message=ihor-sokoliuk&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-searxng&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.2.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed() in src/url-reader.ts runs only when MCP_HTTP_HARDEN is enabled, even though MCP_HTTP_HARDEN is disabled by default in src/http-security.ts. In the default configuration, an attacker who influences the URL selected by a user or AI agent can make the server fetch loopback, private-network, or cloud metadata endpoint resources and return their contents into the model context. file:// URLs remain rejected, and the separate DNS-resolution and redirect-validation bypasses are outside this record. This issue is fixed in version 1.2.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-q87f-qc2r-2gw4
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,19 @@
+### [CVE-2026-54689](https://www.cve.org/CVERecord?id=CVE-2026-54689)
+**mcp-searxng hardened-mode SSRF bypasses permit internal URL access**
+![](https://img.shields.io/static/v1?label=Vendor&message=ihor-sokoliuk&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-searxng&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.2.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-wppf-h75h-6pm6
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55149](https://www.cve.org/CVERecord?id=CVE-2026-55149)
+**Vouch Proxy: Unbounded Multipart Cookie Allocation DoS**
+![](https://img.shields.io/static/v1?label=Vendor&message=vouch&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=vouch-proxy&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.48.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-789%3A%20Memory%20Allocation%20with%20Excessive%20Size%20Value&color=brightgreen)
+
+### Description
+
+Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandler in pkg/jwtmanager/jwtcache.go, FindJWT in pkg/jwtmanager/jwtmanager.go, and the vulnerable cookie reassembly before JWT validation, so no account or valid session is required. A cookie name such as VouchCookie_1of10000000000 causes an attempted slice allocation of roughly 160 GB and a fatal Go runtime out-of-memory condition, allowing one request to crash the authentication proxy and repeated requests to sustain unavailability. This vulnerability is fixed in 0.48.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-qqff-5854-px68
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55591](https://www.cve.org/CVERecord?id=CVE-2026-55591)
+**Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints**
+![](https://img.shields.io/static/v1?label=Vendor&message=SignalK&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=signalk-server&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.28.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security was not configured, addAdminMiddleware() was a no-op in dummysecurity.ts, leaving all three endpoints accessible without authentication. The server could be forced to contact loopback, private, link-local, cloud metadata, or arbitrary external destinations, and selfsignedcert could disable certificate verification for outbound HTTPS requests. The checkAccessRequest endpoint also interpolated requestId into its destination path, allowing traversal to other paths on the selected host. Distinct success, connection-refused, and timeout responses enabled internal port scanning; returned response bodies enabled cloud metadata and internal-service data exfiltration; requestAccess enabled server-side POST requests with attacker-controlled JSON; and access to cluster-internal services could support lateral movement. This issue is fixed in version 2.28.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-q59x-jc9f-gfqf
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55636](https://www.cve.org/CVERecord?id=CVE-2026-55636)
+**Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected**
+![](https://img.shields.io/static/v1?label=Vendor&message=projectcapsule&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=capsule&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.13.0%2C%20%3C%200.13.6&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label. matchPolicy: Equivalent does not compensate because it handles API group and version equivalence rather than resource-name errors. This vulnerability is fixed in 0.13.6.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-gwxr-7h77-7777
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55650](https://www.cve.org/CVERecord?id=CVE-2026-55650)
+**Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure**
+![](https://img.shields.io/static/v1?label=Vendor&message=outerbase&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=studio&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%200.10.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20%28%27Cross-site%20Scripting%27%29&color=brightgreen)
+
+### Description
+
+Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capable event handlers to execute when the widget is displayed. Outerbase Cloud and its backend services were discontinued in 2025, and the current architecture uses local browser dashboard storage, so the impact is limited to local self-XSS. Authentication token theft, account takeover, and backend database access are not applicable to the current architecture. No fixed release is available as of this review.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-wwf9-7jrc-rv4q
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55691](https://www.cve.org/CVERecord?id=CVE-2026-55691)
+**EmbedVideo Extension : Stored XSS via unsanitized class passed to template**
+![](https://img.shields.io/static/v1?label=Vendor&message=StarCitizenWiki&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mediawiki-extensions-EmbedVideo&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20%28%27Cross-site%20Scripting%27%29&color=brightgreen)
+
+### Description
+
+The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedHtmlFormatter::toHtml in includes/EmbedService/EmbedHtmlFormatter.php passes the user-supplied class value directly to sprintf while constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page. A user able to edit a wiki page can store JavaScript that executes for visitors who render the affected content. This issue is fixed in version 4.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-7h5p-637f-jfr7
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55692](https://www.cve.org/CVERecord?id=CVE-2026-55692)
+**EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled**
+![](https://img.shields.io/static/v1?label=Vendor&message=StarCitizenWiki&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mediawiki-extensions-EmbedVideo&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20%28%27Cross-site%20Scripting%27%29&color=brightgreen)
+
+### Description
+
+The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs accepted by the affected service validators can cause getUrl() output to terminate the attribute and inject event-handler attributes into the generated figure element. A user able to edit a wiki page can store JavaScript that executes in the wiki origin when visitors render the page. This issue is fixed in version 4.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-5c7p-g73q-rpg5
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55770](https://www.cve.org/CVERecord?id=CVE-2026-55770)
+**OpenBao: LDAPi ldaputil (wrong escape func)**
+![](https://img.shields.io/static/v1?label=Vendor&message=openbao&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=openbao&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.5.5&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-90%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20LDAP%20Query%20%28%27LDAP%20Injection%27%29&color=brightgreen)
+
+### Description
+
+OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication backend configured for an Active Directory UPNDomain path or UserDN and UserAttr binding, an attacker-controlled username containing filter metacharacters could alter the search predicate and select a different directory entry because EscapeLDAPValue does not neutralize the characters handled by ldap.EscapeFilter. A resulting token could be associated with another LDAP identity and gain access to secrets, policies, or modification capabilities assigned to that identity. This issue is fixed in version 2.5.5.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-6mwx-4547-5vc9
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55775](https://www.cve.org/CVERecord?id=CVE-2026-55775)
+**OpenBao's System Backend allows Unauthorized Management of the containing Namespace**
+![](https://img.shields.io/static/v1?label=Vendor&message=openbao&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=openbao&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.5.5&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen)
+
+### Description
+
+OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/* endpoint family can resolve its containing namespace through a path prefix or X-Vault-Namespace header. ACL checks occurred before root canonicalized to an empty path, causing /sys/namespaces/root to resolve to the system backend's containing namespace and allowing permitted lookups, deletion, locking, or custom metadata changes against that direct containing namespace. The root namespace and arbitrary unrelated namespaces are not affected, and available operations depend on the capabilities granted on the path and subpaths such as /api-lock. This issue is fixed in version 2.5.5.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-mwr2-wmgp-crj6
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-55863](https://www.cve.org/CVERecord?id=CVE-2026-55863)
+**motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution**
+![](https://img.shields.io/static/v1?label=Vendor&message=motioneye-project&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=motioneye&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.44.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send requests to /action/<camera_id>/<action>. The endpoint can trigger snapshot, record_start, and record_stop actions. When an administrator has configured action scripts, the same endpoint can invoke PTZ controls, alarm actions, lighting actions, and other predefined commands, and configured remote motionEye cameras can allow server-side requests to the remote camera service. This issue is fixed in version 0.44.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-j67x-q29f-qcvv
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-56825](https://www.cve.org/CVERecord?id=CVE-2026-56825)
+**Shopper: Missing authorization on product removal actions in CollectionProducts component**
+![](https://img.shields.io/static/v1?label=Vendor&message=shopperlabs&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=shopper&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.9.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-2cg9-97gq-9mqp
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-56827](https://www.cve.org/CVERecord?id=CVE-2026-56827)
+**Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers**
+![](https://img.shields.io/static/v1?label=Vendor&message=shopperlabs&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=shopper&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.9.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-243p-f3cv-c5wh
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-56829](https://www.cve.org/CVERecord?id=CVE-2026-56829)
+**Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component**
+![](https://img.shields.io/static/v1?label=Vendor&message=shopperlabs&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=shopper&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.9.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-g3f9-g5vj-p62f
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-56830](https://www.cve.org/CVERecord?id=CVE-2026-56830)
+**Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization**
+![](https://img.shields.io/static/v1?label=Vendor&message=shopperlabs&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=shopper&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.9.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-99h5-jhh7-v3r3
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-56831](https://www.cve.org/CVERecord?id=CVE-2026-56831)
+**Shopper: Negative discount values accepted and propagated through order calculation pipeline**
+![](https://img.shields.io/static/v1?label=Vendor&message=shopperlabs&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=shopper&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.9.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen)
+
+### Description
+
+Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-5vf4-452p-jjhf
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-57141](https://www.cve.org/CVERecord?id=CVE-2026-57141)
+**PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool**
+![](https://img.shields.io/static/v1?label=Vendor&message=MervinPraison&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.7.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20%28%27Code%20Injection%27%29&color=brightgreen)
+
+### Description
+
+PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist can be bypassed with Function('return this')() to recover the global object and by constructing the child_process module name dynamically. An attacker who can influence the code argument can access host process capabilities, read or write files, obtain environment credentials, and execute operating-system commands with the PraisonAI process privileges. This issue is fixed in version 1.7.2.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-p69m-4f92-2v84
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,21 @@
+### [CVE-2026-57147](https://www.cve.org/CVERecord?id=CVE-2026-57147)
+**praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery**
+![](https://img.shields.io/static/v1?label=Vendor&message=MervinPraison&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=praisonai-platform&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.6.51&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.1.6&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-798%3A%20Use%20of%20Hard-coded%20Credentials&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1188%3A%20Insecure%20Default%20Initialization%20of%20Resource&color=brightgreen)
+
+### Description
+
+PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET is unset, and its production guard does not run when PLATFORM_ENV is also unset because that setting defaults to dev. A remote unauthenticated attacker can mint an HS256 token with an arbitrary sub and email, and the platform's AuthService._verify_token() and get_current_user dependency accept the forged identity for protected API routes. This vulnerability is fixed in praisonai-platform 0.1.6.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-cwj8-7gp2-ggcw
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,22 @@
+### [CVE-2026-57148](https://www.cve.org/CVERecord?id=CVE-2026-57148)
+**praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)**
+![](https://img.shields.io/static/v1?label=Vendor&message=MervinPraison&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=praisonai-platform&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.6.51&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.1.6&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%3A%20Improper%20Authentication&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-798%3A%20Use%20of%20Hard-coded%20Credentials&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1188%3A%20Insecure%20Default%20Initialization%20of%20Resource&color=brightgreen)
+
+### Description
+
+PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner impersonation when a target identifier is known. This vulnerability is fixed in praisonai-platform 0.1.6.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-f38v-77qj-h4jq
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-58196](https://www.cve.org/CVERecord?id=CVE-2026-58196)
+**ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)**
+![](https://img.shields.io/static/v1?label=Vendor&message=stacklok&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=toolhive&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.31.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP clients trust remote-server-controlled authentication discovery destinations, follow redirects without host or scheme restrictions, and do not consistently block private addresses. A malicious or compromised remote MCP server can place a resource_metadata URL in WWW-Authenticate for ParseWWWAuthenticate to extract, after which FetchResourceMetadata, OIDC issuer discovery, and well-known discovery can issue GET requests to link-local, RFC1918, or other internal services outside the server's container. The user connects to a server that the user intends to use, but the server controls the internal destination; this path does not depend on the separate NAT64 guard omission because the affected clients did not invoke IsPrivateIP, and it differs from the DCR resolver path that already refused redirects. The demonstrated primitive reaches internal-only HTTP services and reachability or error oracles, and can retrieve AWS metadata credentials where IMDSv1 accepts an unauthenticated GET, while IMDSv2 and GCP metadata prerequisites are not satisfied by the demonstrated request. This vulnerability is fixed in 0.31.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-pr64-jmmf-jp54
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-59160](https://www.cve.org/CVERecord?id=CVE-2026-59160)
+**Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run**
+![](https://img.shields.io/static/v1?label=Vendor&message=DerYeger&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=yeger&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.8.9&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in packages/turbo-graph-ui/app/api/run/route.ts has no authentication, authorization, CSRF protection, or task allowlist. The handler accepts the tasks, filter, and force query parameters, and buildResponseFromArgs passes attacker-selected task names to spawn() as Turbo CLI arguments. An adjacent-network attacker can execute any task defined in the victim repository's turbo.json with the privileges of the developer OS user, potentially exposing secrets, modifying files or infrastructure, or causing destructive availability effects. The use of an argument array prevents traditional shell metacharacter injection but does not prevent unauthorized execution of defined tasks. This issue is fixed in version 2.8.9.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-2r5q-h53f-9rp3
+
+#### Github
+No PoCs found on GitHub currently.
@@ -18,6 +18,7 @@ Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0
 - https://github.com/jhb-software/payload-plugins/pull/159
 - https://github.com/jhb-software/payload-plugins/commit/e39634868ce13a414e2981e219befc58101654d3
 - https://github.com/jhb-software/payload-plugins/releases/tag/alt-text@0.8.0
+- https://github.com/advisories/GHSA-4qpv-39hg-f7fx

 #### Github
 No PoCs found on GitHub currently.
@@ -0,0 +1,22 @@
+### [CVE-2026-59973](https://www.cve.org/CVERecord?id=CVE-2026-59973)
+**mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi**
+![](https://img.shields.io/static/v1?label=Vendor&message=agentfront&color=blue)
+![](https://img.shields.io/static/v1?label=Vendor&message=%40frontmcp&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=frontmcp&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-from-openapi&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=adapters&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.5.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.5.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-65h7-9wrw-629c
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-61554](https://www.cve.org/CVERecord?id=CVE-2026-61554)
+**emp3r0r has an unauthenticated HTTP Polling DoS**
+![](https://img.shields.io/static/v1?label=Vendor&message=jm33-m0&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=emp3r0r&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.2.5&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+
+### Description
+
+emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-4595-rvpx-4q34
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-61559](https://www.cve.org/CVERecord?id=CVE-2026-61559)
+**@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery**
+![](https://img.shields.io/static/v1?label=Vendor&message=zereight&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=gitlab-mcp&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.0.1%2C%20%3C%202.1.27&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20%28SSRF%29&color=brightgreen)
+
+### Description
+
+`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-2h44-8472-frjj
+
+#### Github
+No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-61568](https://www.cve.org/CVERecord?id=CVE-2026-61568)
+**@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport**
+![](https://img.shields.io/static/v1?label=Vendor&message=zereight&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=gitlab-mcp&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.1.30&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-350%3A%20Reliance%20on%20Reverse%20DNS%20Resolution%20for%20a%20Security-Critical%20Action&color=brightgreen)
+
+### Description
+
+`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch.
+
+### POC
+
+#### Reference
+- https://github.com/advisories/GHSA-vmp7-252j-cwp7
+
+#### Github
+No PoCs found on GitHub currently.
@@ -1,5 +1,5 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="1200" height="180" viewBox="0 0 1200 180"
-     role="img" aria-label="PoC Index, 82,865 CVEs with public proof-of-concept exploits">
+     role="img" aria-label="PoC Index, 82,898 CVEs with public proof-of-concept exploits">
  <clipPath id="card"><rect x="1" y="1" width="1198" height="178" rx="12"/></clipPath>
  <rect x="0.5" y="0.5" width="1199" height="179" rx="12" fill="#0d1117" stroke="#30363d"/>
  <g clip-path="url(#card)" opacity="0.6"><g>
@@ -19,10 +19,10 @@
  <text x="56" y="132" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="15" fill="#2f81f7">pocindex.io</text>

  <text x="620" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
-        fill="#e6edf3" letter-spacing="-0.5">172,045</text>
+        fill="#e6edf3" letter-spacing="-0.5">172,078</text>
  <text x="620" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
        fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="840" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
-        fill="#2f81f7" letter-spacing="-0.5">82,865</text>
+        fill="#2f81f7" letter-spacing="-0.5">82,898</text>
  <text x="840" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
        fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="1010" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
        fill="#f85149" letter-spacing="-0.5">1,197</text>
@@ -20,10 +20,10 @@

  <rect x="96" y="344" width="1088" height="1" fill="#30363d"/>
  <text x="96" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
-        fill="#e6edf3" letter-spacing="-0.5">172,045</text>
+        fill="#e6edf3" letter-spacing="-0.5">172,078</text>
  <text x="96" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
        fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="500" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
-        fill="#2f81f7" letter-spacing="-0.5">82,865</text>
+        fill="#2f81f7" letter-spacing="-0.5">82,898</text>
  <text x="500" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
        fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="880" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
        fill="#f85149" letter-spacing="-0.5">1,197</text>
@@ -1,5 +1,5 @@
 {
 "kev": 1197,
- "total_cves": 172045,
- "with_pocs": 82865
+ "total_cves": 172078,
+ "with_pocs": 82898
 }
@@ -1 +1 @@
-{"CVE-1999-0110":{"checked":"2026-09-01","status":"REJECTED"},"CVE-1999-0335":{"checked":"2026-09-01","status":"REJECTED"},"CVE-1999-0531":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2002-0192":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2002-0828":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2003-0090":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-0122":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-0153":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2005-1032":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-2116":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-2303":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-4633":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2006-3866":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2006-4216":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2007-1570":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2007-5125":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-2737":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-4042":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-4112":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-4189":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-4270":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-6049":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-6628":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2009-0300":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2009-0795":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2009-2259":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2010-0368":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2010-2782":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2010-2972":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2010-3885":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2011-0108":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2011-1656":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2011-2553":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2011-3633":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2011-4779":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2011-5232":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-0722":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-1300":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-1304":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-1305":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-1309":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-1913":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-2216":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-2344":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-2765":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-3539":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-4748":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-4749":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-6315":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-6679":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2013-1298":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-1625":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2013-1805":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-2649":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2013-2749":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-3130":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-4266":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5575":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5581":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5621":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5622":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5623":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5624":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5625":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5627":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5628":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5630":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5631":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5632":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5633":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5689":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5759":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-0982":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-1004":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-1137":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-1155":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-1470":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-2085":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-2239":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2014-2923":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2014-2937":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2Line truncated
+{"CVE-1999-0110":{"checked":"2026-09-01","status":"REJECTED"},"CVE-1999-0335":{"checked":"2026-09-01","status":"REJECTED"},"CVE-1999-0531":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2002-0192":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2002-0828":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2003-0090":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-0122":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-0153":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2005-1032":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-2116":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-2303":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2005-4633":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2006-3866":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2006-4216":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2007-1570":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2007-5125":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-2737":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-4042":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-4112":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-4189":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-4270":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-6049":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2008-6628":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2009-0300":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2009-0795":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2009-2259":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2010-0368":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2010-2782":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2010-2972":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2010-3885":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2011-0108":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2011-1656":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2011-2553":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2011-3633":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2011-4779":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2011-5232":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-0722":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-1300":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-1304":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-1305":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-1309":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-1913":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-2216":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-2344":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-2765":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-3539":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-4748":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-4749":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2012-6315":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2012-6679":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2013-1298":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-1625":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2013-1805":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-2649":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2013-2749":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-3130":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-4266":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5575":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5581":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5621":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5622":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5623":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5624":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5625":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5627":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5628":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5630":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5631":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5632":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5633":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5689":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2013-5759":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-0982":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-1004":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-1137":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-1155":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-1470":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-2085":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2014-2239":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2014-2923":{"checked":"2026-09-15","status":"UNAVAILABLE"},"CVE-2014-2937":{"checked":"2026-09-01","status":"REJECTED"},"CVE-2Line truncated
@@ -1 +1 @@
-{"GHSA-222V-CX2C-Q2F5":["CVE-2025-24530","https://github.com/advisories/GHSA-222v-cx2c-q2f5",[["3.1",6.4,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-11-03T22:54:20Z"],"GHSA-222W-XMC5-JHP3":["CVE-2025-43735","https://github.com/advisories/GHSA-222w-xmc5-jhp3",[["4.0",6.9,"MEDIUM","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-08-12T21:04:35Z"],"GHSA-2234-FMW7-43WR":["CVE-2024-48913","https://github.com/advisories/GHSA-2234-fmw7-43wr",[["3.1",5.9,"MEDIUM","CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","GitHub Advisory Database","GitHub Reviewed"]],1,"2024-11-07T18:33:22Z"],"GHSA-2238-XC5R-V9HJ":["CVE-2026-24125","https://github.com/advisories/GHSA-2238-xc5r-v9hj",[["3.1",6.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","GitHub Advisory Database","GitHub Reviewed"]],1,"2026-03-12T19:13:57Z"],"GHSA-223G-8W3X-98WR":["CVE-2023-34230","https://github.com/advisories/GHSA-223g-8w3x-98wr",[["3.1",7.3,"HIGH","CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-11-06T05:04:15Z"],"GHSA-223G-F5MQ-GW33":["CVE-2026-44720","https://github.com/advisories/GHSA-223g-f5mq-gw33",[["4.0",6.9,"MEDIUM","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-06-08T23:54:58Z"],"GHSA-223J-4RM8-MRMF":["CVE-2025-30218","https://github.com/advisories/GHSA-223j-4rm8-mrmf",[["4.0",1.7,"LOW","CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-10-13T15:35:51Z"],"GHSA-223M-4RFP-646H":["CVE-2025-59475","https://github.com/advisories/GHSA-223m-4rfp-646h",[["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-11-05T20:45:04Z"],"GHSA-223M-PGCQ-F3XG":["CVE-2023-4303","https://github.com/advisories/GHSA-223m-pgcq-f3xg",[["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-11-09T05:03:23Z"],"GHSA-2259-H742-5VR4":["CVE-2021-20250","https://github.com/advisories/GHSA-2259-h742-5vr4",[["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-01-31T05:01:19Z"],"GHSA-225X-3JHX-WH4Q":["CVE-2026-64664","https://github.com/advisories/GHSA-225x-3jhx-wh4q",[["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-08-06T19:22:35Z"],"GHSA-2263-JWGM-WV97":["CVE-2018-16342","https://github.com/advisories/GHSA-2263-jwgm-wv97",[["3.0",5.4,"MEDIUM","CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-10-06T18:02:31Z"],"GHSA-2267-XQCF-GW2M":["CVE-2025-69210","https://github.com/advisories/GHSA-2267-xqcf-gw2m",[["4.0",8.6,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-01-02T22:51:53Z"],"GHSA-2268-98WH-QFHF":["CVE-2023-50572","https://github.com/advisories/GHSA-2268-98wh-qfhf",[["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2024-01-05T19:49:51Z"],"GHSA-226F-F24G-524W":["CVE-2026-54008","https://github.com/advisories/GHSA-226f-f24g-524w",[["3.1",8.5,"HIGH","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","GitHub Advisory Database","GitHub Reviewed"]],1,"2026-06-17T14:10:58Z"],"GHSA-226H-QRG4-8236":["CVE-2020-2269","https://github.com/advisories/GHSA-226h-qrg4-8236",[["3.1",8.0,"HIGH","CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-01-28T05:06:32Z"],"GHSA-2275-RPF5-XV8H":["CVE-2022-25906","https://github.com/advisories/GHSA-2275-rpf5-xv8h",[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-03-27T03:50:00Z"],"GHSA-227G-7CVV-6FF3":["CVE-2022-31781","https://github.com/advisories/GHSA-227g-7cvv-6ff3",[["3.1",7.5,"HIGH","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-07-24T19:38:55Z"],"GHSA-227R-JM2G-7CP4":["CVE-2026-50201","https://github.com/advisories/GHSA-227r-jm2g-7cp4",[["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-07-02T20:31:28Z"],"GHSA-227R-W5J2-6243":["CVE-2024-11042","https://github.com/advisories/GHSA-227r-w5j2-6243",[["3.0",9.1,"CRITICAL","CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-10-15T16:03:29Z"],"GHSA-227W-WV4J-67H4":["CVE-2024-23682","https://github.com/advisories/GHSA-227w-wv4j-67h4",[["3.1",8.2,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-01-22T20:53:44Z"],"GHSA-227X-7MH8-3CF6":["CVE-2025-59823","hLine truncated
+{"GHSA-222V-CX2C-Q2F5":["CVE-2025-24530","https://github.com/advisories/GHSA-222v-cx2c-q2f5",[["3.1",6.4,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-11-03T22:54:20Z"],"GHSA-222W-XMC5-JHP3":["CVE-2025-43735","https://github.com/advisories/GHSA-222w-xmc5-jhp3",[["4.0",6.9,"MEDIUM","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-08-12T21:04:35Z"],"GHSA-2234-FMW7-43WR":["CVE-2024-48913","https://github.com/advisories/GHSA-2234-fmw7-43wr",[["3.1",5.9,"MEDIUM","CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","GitHub Advisory Database","GitHub Reviewed"]],1,"2024-11-07T18:33:22Z"],"GHSA-2238-XC5R-V9HJ":["CVE-2026-24125","https://github.com/advisories/GHSA-2238-xc5r-v9hj",[["3.1",6.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","GitHub Advisory Database","GitHub Reviewed"]],1,"2026-03-12T19:13:57Z"],"GHSA-223G-8W3X-98WR":["CVE-2023-34230","https://github.com/advisories/GHSA-223g-8w3x-98wr",[["3.1",7.3,"HIGH","CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-11-06T05:04:15Z"],"GHSA-223G-F5MQ-GW33":["CVE-2026-44720","https://github.com/advisories/GHSA-223g-f5mq-gw33",[["4.0",6.9,"MEDIUM","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-06-08T23:54:58Z"],"GHSA-223J-4RM8-MRMF":["CVE-2025-30218","https://github.com/advisories/GHSA-223j-4rm8-mrmf",[["4.0",1.7,"LOW","CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-10-13T15:35:51Z"],"GHSA-223M-4RFP-646H":["CVE-2025-59475","https://github.com/advisories/GHSA-223m-4rfp-646h",[["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-11-05T20:45:04Z"],"GHSA-223M-PGCQ-F3XG":["CVE-2023-4303","https://github.com/advisories/GHSA-223m-pgcq-f3xg",[["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-11-09T05:03:23Z"],"GHSA-2259-H742-5VR4":["CVE-2021-20250","https://github.com/advisories/GHSA-2259-h742-5vr4",[["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-01-31T05:01:19Z"],"GHSA-225X-3JHX-WH4Q":["CVE-2026-64664","https://github.com/advisories/GHSA-225x-3jhx-wh4q",[["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-08-06T19:22:35Z"],"GHSA-2263-JWGM-WV97":["CVE-2018-16342","https://github.com/advisories/GHSA-2263-jwgm-wv97",[["3.0",5.4,"MEDIUM","CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-10-06T18:02:31Z"],"GHSA-2267-XQCF-GW2M":["CVE-2025-69210","https://github.com/advisories/GHSA-2267-xqcf-gw2m",[["4.0",8.6,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-01-02T22:51:53Z"],"GHSA-2268-98WH-QFHF":["CVE-2023-50572","https://github.com/advisories/GHSA-2268-98wh-qfhf",[["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2024-01-05T19:49:51Z"],"GHSA-226F-F24G-524W":["CVE-2026-54008","https://github.com/advisories/GHSA-226f-f24g-524w",[["3.1",8.5,"HIGH","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","GitHub Advisory Database","GitHub Reviewed"]],1,"2026-06-17T14:10:58Z"],"GHSA-226H-QRG4-8236":["CVE-2020-2269","https://github.com/advisories/GHSA-226h-qrg4-8236",[["3.1",8.0,"HIGH","CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-01-28T05:06:32Z"],"GHSA-2275-RPF5-XV8H":["CVE-2022-25906","https://github.com/advisories/GHSA-2275-rpf5-xv8h",[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-03-27T03:50:00Z"],"GHSA-227G-7CVV-6FF3":["CVE-2022-31781","https://github.com/advisories/GHSA-227g-7cvv-6ff3",[["3.1",7.5,"HIGH","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2023-07-24T19:38:55Z"],"GHSA-227R-JM2G-7CP4":["CVE-2026-50201","https://github.com/advisories/GHSA-227r-jm2g-7cp4",[["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-07-02T20:31:28Z"],"GHSA-227R-W5J2-6243":["CVE-2024-11042","https://github.com/advisories/GHSA-227r-w5j2-6243",[["3.0",9.1,"CRITICAL","CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2025-10-15T16:03:29Z"],"GHSA-227W-WV4J-67H4":["CVE-2024-23682","https://github.com/advisories/GHSA-227w-wv4j-67h4",[["3.1",8.2,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","GitHub Advisory Database","GitHub Reviewed"]],0,"2026-01-22T20:53:44Z"],"GHSA-227X-7MH8-3CF6":["CVE-2025-59823","hLine truncated
@@ -1 +1 @@
-{"CVE-2023-0001":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0001",["Vendor Advisory"]]],"cvss":[["3.1",6.7,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",6.0,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","[email protected]","Secondary"]]},"CVE-2023-0002":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0002",["Vendor Advisory"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","[email protected]","Secondary"]]},"CVE-2023-0003":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0003",["Vendor Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y",["Third Party Advisory"]]],"cvss":[["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","[email protected]","Primary"],["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","[email protected]","Secondary"]]},"CVE-2023-0004":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0004",["Vendor Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y",["Third Party Advisory"]]],"cvss":[["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","[email protected]","Primary"],["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","[email protected]","Secondary"]]},"CVE-2023-0005":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0005",["Vendor Advisory"]]],"cvss":[["3.1",4.9,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","[email protected]","Primary"],["3.1",4.1,"MEDIUM","CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","[email protected]","Secondary"]]},"CVE-2023-0012":{"advisories":[["https://launchpad.support.sap.com/#/notes/3276120",["Vendor Advisory"]],["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",["Vendor Advisory"]]],"cvss":[["3.1",6.7,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",6.4,"MEDIUM","CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2023-0013":{"advisories":[["https://launchpad.support.sap.com/#/notes/3283283",["Vendor Advisory"]],["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",["Vendor Advisory"]]],"cvss":[["3.1",6.1,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","[email protected]","Primary"],["3.1",6.1,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","[email protected]","Secondary"]]},"CVE-2023-0014":{"advisories":[["https://launchpad.support.sap.com/#/notesLine truncated
+{"CVE-2023-0001":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0001",["Vendor Advisory"]]],"cvss":[["3.1",6.7,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",6.0,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","[email protected]","Secondary"]]},"CVE-2023-0002":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0002",["Vendor Advisory"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","[email protected]","Secondary"]]},"CVE-2023-0003":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0003",["Vendor Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y",["Third Party Advisory"]]],"cvss":[["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","[email protected]","Primary"],["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","[email protected]","Secondary"]]},"CVE-2023-0004":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0004",["Vendor Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG",["Third Party Advisory"]],["https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y",["Third Party Advisory"]]],"cvss":[["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","[email protected]","Primary"],["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","[email protected]","Secondary"]]},"CVE-2023-0005":{"advisories":[["https://security.paloaltonetworks.com/CVE-2023-0005",["Vendor Advisory"]]],"cvss":[["3.1",4.9,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","[email protected]","Primary"],["3.1",4.1,"MEDIUM","CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","[email protected]","Secondary"]]},"CVE-2023-0012":{"advisories":[["https://launchpad.support.sap.com/#/notes/3276120",["Vendor Advisory"]],["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",["Vendor Advisory"]]],"cvss":[["3.1",6.7,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",6.4,"MEDIUM","CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2023-0013":{"advisories":[["https://launchpad.support.sap.com/#/notes/3283283",["Vendor Advisory"]],["https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",["Vendor Advisory"]]],"cvss":[["3.1",6.1,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","[email protected]","Primary"],["3.1",6.1,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","[email protected]","Secondary"]]},"CVE-2023-0014":{"advisories":[["https://launchpad.support.sap.com/#/notesLine truncated
@@ -1 +1 @@
-{"CVE-2024-0001":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",10.0,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0002":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",10.0,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0003":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",7.2,"HIGH","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0004":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",7.2,"HIGH","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0005":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",8.8,"HIGH","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0006":{"cvss":[["4.0",5.4,"MEDIUM","CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","[email protected]","Secondary"]]},"CVE-2024-0010":{"advisories":[["https://security.paloaltonetworks.com/CVE-2024-0010",["Vendor Advisory"]]],"cvss":[["3.1",6.1,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","[email protected]","Primary"],["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","[email protected]","Secondary"]]},"CVE-2024-0012":{"advisories":[["https://security.paloaltonetworks.com/CVE-2024-0012",["Vendor Advisory"]],["https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474",["Vendor Advisory"]],["https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474",["Third Party Advisory","Exploit"]]],"cvss":[["4.0",9.3,"CRITICAL","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red","[email protected]","Secondary"],["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2024-0014":{"advisories":[["https://source.android.com/security/bulletin/2024-02-01",["Vendor Advisory"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",8.4,"HIGH","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0015":{"advisories":[["https://source.android.com/security/bulletin/2024-01-01",["Vendor Advisory","Patch"]],["https://android.googlesource.com/platform/frameworks/base/+/2ce1b7fd37273ea19fbbb6daeeaa6212357b9a70",["Patch"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0016":{"advisories":[["https://source.android.com/security/bulletin/2024-01-01",["Vendor Advisory","Patch"]],["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/1d7ba7c8a205522f384e8d5c7c9f26a421cab5f1",["Patch"]]],"cvss":[["3.1",5.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","[email protected]","Primary"],["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0017":{"advisories":[["https://source.android.com/security/bulletin/2024-01-01",["Vendor Advisory","Patch"]],["https://android.googlesource.com/platform/packages/apps/Camera2/+/5c4c4b35754eef319dcd69c422f0b1ac0c823f6e",["Patch"]]],"cvss":[["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","[email protected]","Primary"],["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0023":{"advisories":[["https://source.android.com/security/bulletin/2024-01-01",["Vendor Advisory","Patch"]],["https://android.googlesource.com/platform/frameworks/av/+/30b1b34cfd5abfcfee759e7d13167d368ac6c268",["Patch"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",7.4,"HIGH","CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0028":{"advisories":[["https://source.android.com/security/bulletLine truncated
+{"CVE-2024-0001":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",10.0,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0002":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",10.0,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0003":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",7.2,"HIGH","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0004":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",7.2,"HIGH","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0005":{"advisories":[["https://purestorage.com/security",["Vendor Advisory"]]],"cvss":[["3.1",8.8,"HIGH","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","[email protected]","Secondary"]]},"CVE-2024-0006":{"cvss":[["4.0",5.4,"MEDIUM","CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","[email protected]","Secondary"]]},"CVE-2024-0010":{"advisories":[["https://security.paloaltonetworks.com/CVE-2024-0010",["Vendor Advisory"]]],"cvss":[["3.1",6.1,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","[email protected]","Primary"],["3.1",4.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","[email protected]","Secondary"]]},"CVE-2024-0012":{"advisories":[["https://security.paloaltonetworks.com/CVE-2024-0012",["Vendor Advisory"]],["https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474",["Vendor Advisory"]],["https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474",["Third Party Advisory","Exploit"]]],"cvss":[["4.0",9.3,"CRITICAL","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red","[email protected]","Secondary"],["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2024-0014":{"advisories":[["https://source.android.com/security/bulletin/2024-02-01",["Vendor Advisory"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",8.4,"HIGH","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0015":{"advisories":[["https://source.android.com/security/bulletin/2024-01-01",["Vendor Advisory","Patch"]],["https://android.googlesource.com/platform/frameworks/base/+/2ce1b7fd37273ea19fbbb6daeeaa6212357b9a70",["Patch"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0016":{"advisories":[["https://source.android.com/security/bulletin/2024-01-01",["Vendor Advisory","Patch"]],["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/1d7ba7c8a205522f384e8d5c7c9f26a421cab5f1",["Patch"]]],"cvss":[["3.1",5.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","[email protected]","Primary"],["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0017":{"advisories":[["https://source.android.com/security/bulletin/2024-01-01",["Vendor Advisory","Patch"]],["https://android.googlesource.com/platform/packages/apps/Camera2/+/5c4c4b35754eef319dcd69c422f0b1ac0c823f6e",["Patch"]]],"cvss":[["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","[email protected]","Primary"],["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0023":{"advisories":[["https://source.android.com/security/bulletin/2024-01-01",["Vendor Advisory","Patch"]],["https://android.googlesource.com/platform/frameworks/av/+/30b1b34cfd5abfcfee759e7d13167d368ac6c268",["Patch"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",7.4,"HIGH","CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2024-0028":{"advisories":[["https://source.android.com/security/bulletLine truncated
@@ -1 +1 @@
-{"CVE-2025-0001":{"cvss":[["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","[email protected]","Secondary"]]},"CVE-2025-0009":{"cvss":[["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","[email protected]","Secondary"]]},"CVE-2025-0010":{"cvss":[["3.1",6.1,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","[email protected]","Secondary"]]},"CVE-2025-0011":{"cvss":[["3.1",3.3,"LOW","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","[email protected]","Secondary"]]},"CVE-2025-0015":{"advisories":[["https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities",["Vendor Advisory"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0032":{"cvss":[["3.1",7.2,"HIGH","CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","[email protected]","Secondary"]]},"CVE-2025-0034":{"cvss":[["3.1",4.7,"MEDIUM","CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","[email protected]","Secondary"]]},"CVE-2025-0050":{"advisories":[["https://developer.arm.com/documentation/110435/latest",["Vendor Advisory"]]],"cvss":[["3.1",5.9,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0054":{"cvss":[["3.1",5.4,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","[email protected]","Secondary"]]},"CVE-2025-0072":{"advisories":[["https://developer.arm.com/documentation/110465/latest",["Vendor Advisory"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0074":{"advisories":[["https://source.android.com/security/bulletin/2025-03-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/37bcf769c1aa8dfa8e5524858d47f6a80b765fa4",["Product"]]],"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0075":{"advisories":[["https://source.android.com/security/bulletin/2025-03-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5959f8bcf4efe924b0ba4dbcbfe83e602f0eb0ac",["Product"]]],"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0076":{"advisories":[["https://source.android.com/security/bulletin/2025-09-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/frameworks/base/+/d6ad7f34eaf5f0452b93a650265ee432288c0978",["Patch","Product"]]],"cvss":[["3.1",3.3,"LOW","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0086":{"advisories":[["https://source.android.com/security/bulletin/2025-03-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/frameworks/base/+/c1aa9e662464b8fa49765d53a82efa8e06bb176a",["Product"]]],"cvss":[["3.1",6.2,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0087":{"advisories":[["https://source.android.com/security/bulletin/2025-05-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/frameworks/base/+/4c269d7b0ec71951f773844b2a325e556f982a9c",["Product"]]],"cvss":[["3.1",5.1,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0107":{"advisories":[["https://security.paloaltonetworks.com/PAN-SA-2025-0001",["Vendor Advisory"]]],"cvss":[["4.0",7.7,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Green","[email protected]","Secondary"],["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2025-0108":{"advisories":[["https://security.paloaltonetworks.com/CVE-2025-0108",["Vendor Advisory","Exploit"]],["https://github.com/iSee857/CVE-2025-0108-PoC",["Third Party Advisory","Exploit"]],["https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks",["Third Party Advisory"]],["https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild",["Third Party Advisory"]],["https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability",["Third Party Advisory"]],["https://www.theregister.com/2025/02/19/palo_alto_firewall_attack",["Third Party Advisory"]]],"cvss":[["4.0",8.8,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Red","[email protected]","Secondary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","nvd@nLine truncated
+{"CVE-2025-0001":{"cvss":[["3.1",6.5,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","[email protected]","Secondary"]]},"CVE-2025-0009":{"cvss":[["3.1",5.5,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","[email protected]","Secondary"]]},"CVE-2025-0010":{"cvss":[["3.1",6.1,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","[email protected]","Secondary"]]},"CVE-2025-0011":{"cvss":[["3.1",3.3,"LOW","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","[email protected]","Secondary"]]},"CVE-2025-0015":{"advisories":[["https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities",["Vendor Advisory"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0032":{"cvss":[["3.1",7.2,"HIGH","CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","[email protected]","Secondary"]]},"CVE-2025-0034":{"cvss":[["3.1",4.7,"MEDIUM","CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","[email protected]","Secondary"]]},"CVE-2025-0050":{"advisories":[["https://developer.arm.com/documentation/110435/latest",["Vendor Advisory"]]],"cvss":[["3.1",5.9,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0054":{"cvss":[["3.1",5.4,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","[email protected]","Secondary"]]},"CVE-2025-0072":{"advisories":[["https://developer.arm.com/documentation/110465/latest",["Vendor Advisory"]]],"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0074":{"advisories":[["https://source.android.com/security/bulletin/2025-03-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/37bcf769c1aa8dfa8e5524858d47f6a80b765fa4",["Product"]]],"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0075":{"advisories":[["https://source.android.com/security/bulletin/2025-03-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/5959f8bcf4efe924b0ba4dbcbfe83e602f0eb0ac",["Product"]]],"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0076":{"advisories":[["https://source.android.com/security/bulletin/2025-09-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/frameworks/base/+/d6ad7f34eaf5f0452b93a650265ee432288c0978",["Patch","Product"]]],"cvss":[["3.1",3.3,"LOW","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0086":{"advisories":[["https://source.android.com/security/bulletin/2025-03-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/frameworks/base/+/c1aa9e662464b8fa49765d53a82efa8e06bb176a",["Product"]]],"cvss":[["3.1",6.2,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0087":{"advisories":[["https://source.android.com/security/bulletin/2025-05-01",["Vendor Advisory"]],["https://android.googlesource.com/platform/frameworks/base/+/4c269d7b0ec71951f773844b2a325e556f982a9c",["Product"]]],"cvss":[["3.1",5.1,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2025-0107":{"advisories":[["https://security.paloaltonetworks.com/PAN-SA-2025-0001",["Vendor Advisory"]]],"cvss":[["4.0",7.7,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Green","[email protected]","Secondary"],["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2025-0108":{"advisories":[["https://security.paloaltonetworks.com/CVE-2025-0108",["Vendor Advisory","Exploit"]],["https://github.com/iSee857/CVE-2025-0108-PoC",["Third Party Advisory","Exploit"]],["https://www.bleepingcomputer.com/news/security/palo-alto-networks-tags-new-firewall-bug-as-exploited-in-attacks",["Third Party Advisory"]],["https://www.darkreading.com/remote-workforce/patch-now-cisa-researchers-warn-palo-alto-flaw-exploited-wild",["Third Party Advisory"]],["https://www.securityweek.com/palo-alto-networks-confirms-exploitation-of-firewall-vulnerability",["Third Party Advisory"]],["https://www.theregister.com/2025/02/19/palo_alto_firewall_attack",["Third Party Advisory"]]],"cvss":[["4.0",8.8,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Red","[email protected]","Secondary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","nvd@nLine truncated
@@ -1 +1 @@
-{"CVE-2026-0006":{"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0013":{"cvss":[["3.1",8.4,"HIGH","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0023":{"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0047":{"cvss":[["3.1",8.4,"HIGH","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0049":{"advisories":[["https://source.android.com/docs/security/bulletin/2026/2026-04-01",["Vendor Advisory"]]],"cvss":[["3.1",6.2,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0059":{"advisories":[["https://source.android.com/docs/security/bulletin/2026/2026-06-01",["Vendor Advisory"]]],"cvss":[["3.1",8.0,"HIGH","CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0073":{"advisories":[["https://source.android.com/docs/security/bulletin/2026/2026-05-01",["Vendor Advisory"]]],"cvss":[["3.1",8.8,"HIGH","CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0092":{"advisories":[["https://source.android.com/docs/security/bulletin/android-17",["Vendor Advisory"]]],"cvss":[["4.0",10.0,"CRITICAL","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","[email protected]","Secondary"]]},"CVE-2026-0163":{"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0227":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0227",["Vendor Advisory"]]],"cvss":[["4.0",6.6,"MEDIUM","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber","[email protected]","Secondary"],["3.1",7.5,"HIGH","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","[email protected]","Primary"]]},"CVE-2026-0257":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0257",["Vendor Advisory"]],["https://cert-portal.siemens.com/productcert/html/ssa-967325.html",["Third Party Advisory"]]],"cvss":[["4.0",7.8,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red","[email protected]","Secondary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","[email protected]","Primary"]]},"CVE-2026-0265":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0265",["Vendor Advisory"]],["https://cert-portal.siemens.com/productcert/html/ssa-967325.html",["Third Party Advisory"]]],"cvss":[["4.0",7.2,"HIGH","CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red","[email protected]","Secondary"],["3.1",8.1,"HIGH","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2026-0273":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0273",["Vendor Advisory"]]],"cvss":[["4.0",6.1,"MEDIUM","CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","[email protected]","Secondary"],["3.1",7.2,"HIGH","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2026-0300":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0300",["Vendor Advisory","Mitigation"]],["https://cert-portal.siemens.com/productcert/html/ssa-967325.html",["Third Party Advisory"]]],"cvss":[["4.0",9.3,"CRITICAL","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red","[email protected]","Secondary"],["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2026-0542":{"cvss":[["4.0",9.2,"CRITICAL","CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","[email protected]","Secondary"]]},"CVE-2026-0544":{"advisories":[["https://github.com/ltranquility/CVE/issues/31",["Third Party Advisory","Issue Tracking","Exploit"]],["https://vuldb.com/?id.339331",["Third Party Advisory"]],["https://vuldb.com/?submit.728909",["Third Party Advisory"Line truncated
+{"CVE-2026-0006":{"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0013":{"cvss":[["3.1",8.4,"HIGH","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0023":{"cvss":[["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"],["3.1",7.8,"HIGH","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0047":{"cvss":[["3.1",8.4,"HIGH","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0049":{"advisories":[["https://source.android.com/docs/security/bulletin/2026/2026-04-01",["Vendor Advisory"]]],"cvss":[["3.1",6.2,"MEDIUM","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0059":{"advisories":[["https://source.android.com/docs/security/bulletin/2026/2026-06-01",["Vendor Advisory"]]],"cvss":[["3.1",8.0,"HIGH","CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0073":{"advisories":[["https://source.android.com/docs/security/bulletin/2026/2026-05-01",["Vendor Advisory"]]],"cvss":[["3.1",8.8,"HIGH","CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0092":{"advisories":[["https://source.android.com/docs/security/bulletin/android-17",["Vendor Advisory"]]],"cvss":[["4.0",10.0,"CRITICAL","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","[email protected]","Secondary"]]},"CVE-2026-0163":{"cvss":[["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary"]]},"CVE-2026-0227":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0227",["Vendor Advisory"]]],"cvss":[["4.0",6.6,"MEDIUM","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber","[email protected]","Secondary"],["3.1",7.5,"HIGH","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","[email protected]","Primary"]]},"CVE-2026-0257":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0257",["Vendor Advisory"]],["https://cert-portal.siemens.com/productcert/html/ssa-967325.html",["Third Party Advisory"]]],"cvss":[["4.0",7.8,"HIGH","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red","[email protected]","Secondary"],["3.1",9.1,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","[email protected]","Primary"]]},"CVE-2026-0265":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0265",["Vendor Advisory"]],["https://cert-portal.siemens.com/productcert/html/ssa-967325.html",["Third Party Advisory"]]],"cvss":[["4.0",7.2,"HIGH","CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red","[email protected]","Secondary"],["3.1",8.1,"HIGH","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2026-0273":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0273",["Vendor Advisory"]]],"cvss":[["4.0",6.1,"MEDIUM","CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","[email protected]","Secondary"],["3.1",7.2,"HIGH","CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2026-0300":{"advisories":[["https://security.paloaltonetworks.com/CVE-2026-0300",["Vendor Advisory","Mitigation"]],["https://cert-portal.siemens.com/productcert/html/ssa-967325.html",["Third Party Advisory"]]],"cvss":[["4.0",9.3,"CRITICAL","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red","[email protected]","Secondary"],["3.1",9.8,"CRITICAL","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","[email protected]","Primary"]]},"CVE-2026-0542":{"cvss":[["4.0",9.2,"CRITICAL","CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","[email protected]","Secondary"]]},"CVE-2026-0544":{"advisories":[["https://github.com/ltranquility/CVE/issues/31",["Third Party Advisory","Issue Tracking","Exploit"]],["https://vuldb.com/?id.339331",["Third Party Advisory"]],["https://vuldb.com/?submit.728909",["Third Party Advisory"Line truncated
@@ -117198,3 +117198,37 @@ CVE-2026-91997 - https://github.com/geo-chen/oss/blob/main/evolution-api.md
 CVE-2026-91998 - https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-2-application-credential-authorization-bypass-in-apimcp-enables-unrestricted-cross-organization-user-administration
 CVE-2026-92221 - https://github.com/gedelumbung/HospitalManagement/issues/4
 CVE-2026-92247 - https://github.com/d1n3sh-0x3/synaptikcms-security-research
+CVE-2026-48987 - https://github.com/advisories/GHSA-c2f9-4mc8-j656
+CVE-2026-49446 - https://github.com/advisories/GHSA-2rx5-2g7j-2659
+CVE-2026-53710 - https://github.com/advisories/GHSA-xm98-3vcf-fph7
+CVE-2026-53957 - https://github.com/advisories/GHSA-2xhg-73j7-rrgx
+CVE-2026-54450 - https://github.com/advisories/GHSA-pph6-vfjv-vpjw
+CVE-2026-54547 - https://github.com/advisories/GHSA-2v2f-mvfg-ph56
+CVE-2026-54549 - https://github.com/advisories/GHSA-45gf-fjxp-cjpq
+CVE-2026-54637 - https://github.com/advisories/GHSA-chwm-m7g7-685g
+CVE-2026-54688 - https://github.com/advisories/GHSA-q87f-qc2r-2gw4
+CVE-2026-54689 - https://github.com/advisories/GHSA-wppf-h75h-6pm6
+CVE-2026-55149 - https://github.com/advisories/GHSA-qqff-5854-px68
+CVE-2026-55591 - https://github.com/advisories/GHSA-q59x-jc9f-gfqf
+CVE-2026-55636 - https://github.com/advisories/GHSA-gwxr-7h77-7777
+CVE-2026-55650 - https://github.com/advisories/GHSA-wwf9-7jrc-rv4q
+CVE-2026-55691 - https://github.com/advisories/GHSA-7h5p-637f-jfr7
+CVE-2026-55692 - https://github.com/advisories/GHSA-5c7p-g73q-rpg5
+CVE-2026-55770 - https://github.com/advisories/GHSA-6mwx-4547-5vc9
+CVE-2026-55775 - https://github.com/advisories/GHSA-mwr2-wmgp-crj6
+CVE-2026-55863 - https://github.com/advisories/GHSA-j67x-q29f-qcvv
+CVE-2026-56825 - https://github.com/advisories/GHSA-2cg9-97gq-9mqp
+CVE-2026-56827 - https://github.com/advisories/GHSA-243p-f3cv-c5wh
+CVE-2026-56829 - https://github.com/advisories/GHSA-g3f9-g5vj-p62f
+CVE-2026-56830 - https://github.com/advisories/GHSA-99h5-jhh7-v3r3
+CVE-2026-56831 - https://github.com/advisories/GHSA-5vf4-452p-jjhf
+CVE-2026-57141 - https://github.com/advisories/GHSA-p69m-4f92-2v84
+CVE-2026-57147 - https://github.com/advisories/GHSA-cwj8-7gp2-ggcw
+CVE-2026-57148 - https://github.com/advisories/GHSA-f38v-77qj-h4jq
+CVE-2026-58196 - https://github.com/advisories/GHSA-pr64-jmmf-jp54
+CVE-2026-59160 - https://github.com/advisories/GHSA-2r5q-h53f-9rp3
+CVE-2026-59965 - https://github.com/advisories/GHSA-4qpv-39hg-f7fx
+CVE-2026-59973 - https://github.com/advisories/GHSA-65h7-9wrw-629c
+CVE-2026-61554 - https://github.com/advisories/GHSA-4595-rvpx-4q34
+CVE-2026-61559 - https://github.com/advisories/GHSA-2h44-8472-frjj
+CVE-2026-61568 - https://github.com/advisories/GHSA-vmp7-252j-cwp7